Iv been looking into active killdisk to erase some hard drives so that I can dispose/reuse them which I can then give the certificate it produces to the customer/client on the report it says the method and time and such but also has a entry for verification percentage.
By default all methods default the percentage to 10%.
2 things raised a question:
So far, we have tried creating RAID 5, then swap the disks slots and then created a RAID 6 over them and after spending $30k in professional services, we could not recover data from the 6 HDD. This was sort of a POC in 2015.
So most are home users so it would be pictures of family the odd passport scan
A few are work machines ranging from design work to financial services and I have 2 machine that were part of a dentist office which I imagin having patients records
As an alternative to DBAN see if GitHub - martijnvanbrummelen/nwipe: nwipe secure disk eraser meets your needs.It has an iso to make a bootable medium. And if you look at the display in the box you can see that you get a display showing whether the wipe has succeeded or not. If you want evidence just take a picture of your screen.
Writing zeros to every location takes a long time. Easier, quicker and more secure to use the chisel method on those old hard drives that have no future use and you can just take a picture of before and after as evidence if you need it.
In lieu of that, when physical destruction is preferred, I use either a .45 or a 9mm pistol to take care of it. That way I get a bit of fun out of it. Of course, there are those who will ALWAYS debate the merits of one caliber over the other, but I find that in this instance both are quite effective as long as my aim is decent.
For the record I spent a few hours one day investigating the possibility of data recovery off of a a drive overwritten with zeros. There were alot of theories, but no one has yet been able to prove it is possible. There are rewards if you can.
I'm getting working experience as hardware tech guy meaning I have to repair and fix used computers daily. One of those tasks is formatting all the hard disks and we use Killdisk active@, at Work for erasing all the data.
Active@ also has a data recovery option which is one of my favorites. -recovery.com/ It's thorough, often produces results even after an entire format and partial over write. I've used this tool hundreds of times on client's deleted/lost/formatted family photos, dissertations, etc...
A commonly known one is Recuva. Not my favorite since it takes an extremely long time to scan especially since the "Deep Scan" option is the only one that seems to produce any results. It's handy when you know exactly what your looking for and need/want a live program rather than a bootable one.
All this to say that data wiping/formatting is mostly effective when drives have been wiped and over written several times, redundantly. I've never used Active@ KillDisk (My personal preference is D.B.A.N.) but surely it has various degrees of wiping.
If someone is trying to steal banking passwords, identities, etc... they aren't going to be buying USED computers in hopes that forensic level data recovery will produce thousands of fragments of data. That they then have to sifted through to see if it's enough information (assuming it exists at all) to allow them to JUST begin the real crime.
This article describes the process of changing the location where the killdisk erase certificates are saved. They can be saved to a specific directory, network share, or configured to print automatically.
Organizations are increasingly reliant on technology, automation and operations data to drive productivity gains, margin improvement and cost containment goals. At the same time, it has never been more difficult for organizations to understand and secure the digital environment in which they operate, or their interactions with it.
Cyber incidents can be malicious or unintentional. They range from business service interruptions, large-scale data breaches of commercial, personal and customer information, to cyber fraud and ransomware (such as WannaCry and NotPetya) and advanced persistence threat campaigns on strategic targets.
By 2021, the global cost of cybersecurity breaches is expected to reach US$6 trillion, double the total for 20151. The World Economic Forum now rates a large-scale breach of cybersecurity as one of the five most serious risks facing the world today2.
The large number of connected devices across operating environments is also contributing to the growing threat. With increasing investment in digital, reliance on automation systems, remote monitoring of infrastructure for long-term cost efficiency and near real-time decision-making across the value chain, it is the norm for mining and metals companies to have thousands of OT devices connected across geographical environments.
As a result, the entire supply chain is now at risk, which is not limited to the potential of causing disruptions to operations, but worse, significant health and safety consequences (e.g., resulting from shutdown or overriding of fail-safe systems, physical failure of infrastructure, equipment operating outside of expected parameters etc.). If these risks are not being effectively identified, tracked and monitored, it is likely that the organization and its employees will be left significantly exposed. Some of our clients with strong security event monitoring solutions are seeing a rapid increase in the number of new attacks on operational systems, including viruses that are specifically designed to attack these environments.
Mounting threat levels now require a more robust response. Our 2017 Global Information Security Survey revealed that 53% of energy and resources organizations have increased their spend on cybersecurity over the last 12 months. Cybersecurity budgets are increasing, but are not enough to effectively manage risk, particularly to mission critical OT3. As mining and metals companies continue to move into the digital age, current budgets may not be enough to manage risk, particularly in regard to the growing threat to OT.
Also, too many mining and metals companies are taking an ad hoc approach or acting when it is already too late to manage their risks and vulnerabilities. This approach unnecessarily exposes the enterprise to greater threats.
The responsibility of managing exposure to cybersecurity risks is not one that can be delegated to one or two individuals. Rather, a broad range of individual responsibilities should be brought together to form a single coherent and accessible view of the threat environment.
For example, OT cyber risks may require different technology, engineering, maintenance and process control teams to be responsible and consulted to establish the critical cyber controls and security awareness. However, an accountable owner, such as a Chief Operating Officer or Site General Manager, is needed to drive the change and priority, and sustain ongoing OT cyber risk management.
Organizations need to apply good risk management principles; and this starts with thinking about the issue such as cyber risk, just like a business risk. Understanding the cyber threat landscape is the first and vital foundation step in the change to improve the cyber maturity. In order to address the step-change needed, mining and metals companies need to have a clear plan that forms part of their digital road map and risk management plan.
Boards are taking an increasingly active role in addressing the risks that cybersecurity risks posed to their business. There is an increasing demand on management to generate reporting, metrics and insight that provide visibility and assurance over the management of cybersecurity risks.
Most organizations struggle with understanding what to report to the board. This is indicative of the traditional reporting mindset that tends to focus on informing tactical decision-making and reporting on current progress. Instead, board reporting should seek to combine tangible and quantifiable metrics that demonstrate the outcomes resulting from recent key decisions and the performance of the current control environment.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
EY is a global leader in assurance, consulting, strategy and transactions, and tax services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.
This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice.
c80f0f1006