Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

2/22/2011
11:56 AM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Researchers: SSD Drives Pose Data Sanitation Risk

Researchers from the University of California, San Diego are warning that traditional methods to clear data from hard drives may not work as well on Solid State Disks.

Researchers from the University of California, San Diego are warning that traditional methods to clear data from hard drives may not work as well on Solid State Disks.For those who need to make certain that sensitive data is cleared from their drives after systems are decommissioned, or if they're being transferred to other employees or users – SSD drives may pose a serious challenged.

According to this study, the researchers evaluated 12 SSDs, of those that had built in ATA and SCSI commands for wiping data – only eight of the twelve – half of the wiping routines on those eight didn't work.

The researchers suggest, instead, that disks be encrypted as soon as the initial system image is created.

They found that degaussing the drives (using magnetism to destroy the structure of the data) didn't work properly. And software wiping of individual files could not be relied upon to properly work with native routines. However, wiping the entire drive with software routines worked often, but not always.

The team provided tools they believe make file sanitation more effective. "Overall, we conclude that the increased complexity of SSDs relative to hard drives requires that SSDs provide verifiable sanitization operations," the report concluded.

This news is troubling for those in industries with highly-sensitive, confidential, or regulated industries who must ensure drive data is properly destroyed.

Colleague Mathew J. Schwartz covers more detail in his story, SSDs Prove Tough To Erase:

How can SSDs be effectively secured or disposed of, short of physically destroying them? The researchers propose encrypting all data from the start, then destroying the encryption keys and overwriting every page of data to securely wipe the SSD and block future key recovery.

Implementing such an approach requires planning. "To properly secure data and take advantage of the performance benefits that SSDs offer, you should always encrypt the entire disk and do so as soon as the operating system is installed," said Chester Wisniewski, a senior security advisor for Sophos Canada, in a blog post. Based on the researchers' findings, "securely erasing SSDs after they have been used unencrypted is very difficult, and may be impossible in some cases," he said.

For my security and technology observations throughout the day, find me on Twitter as @georgevhulme.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27621
PUBLISHED: 2020-10-22
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inab...
CVE-2020-27620
PUBLISHED: 2020-10-22
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.
CVE-2020-27619
PUBLISHED: 2020-10-22
In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP.
CVE-2020-17454
PUBLISHED: 2020-10-21
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload into the owner POST parameter, which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name, a modal b...
CVE-2020-24421
PUBLISHED: 2020-10-21
Adobe InDesign version 15.1.2 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .indd file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.