search

martijnvanbrummelen / nwipe

nwipe secure disk eraser
GNU General Public License v2.0
688 stars 79 forks source link

PDF Requirements according to Standards #595

Open fthobe opened 2 weeks ago

fthobe commented 2 weeks ago

WARNING Rolling Release Base, Changes / Additions might occur

Current State of Issue

Missing Components in this issue

Data Wipe Certification According to Standard

The current certification provides significant value, but does not contain all mandatory and / or optional fields to certify the destruction of the disk contained data. This issue outlines eventual shortcomings.

Applies to following standards

The following table illustrates the requirements for the documentation of a sanitisation according to various standards. Currently documented are:

  1. US: NIST SP 800-88 Rev. 1 requires a form similar to the appendix of the linked standard.

  2. US: DoD I 8500.01 (refers to NIST SP 800-88) DOD M 4160.21 Vol 4 requires form 2500 similar to the document here.

  3. US: DoD 5220.22-M requires a very reduced form

  4. Canada: ITSP 40006: see US: NIST SP 800-88 Rev. 1

  5. Germany: CON.6

Screenshot 2024-08-27 at 14 58 38

Particular Requirements

Different Tool for Verification

Following standards require a different tool for verification:

  1. NIST SP 800-88 Rev. 1
  2. ITSP 40006 according to NIST SP 800-88

Control of Disk Size

Following Standards require to mathematically compare disk size before cancellation and after verification:

  1. ITSP 40006

Validation of Tool itself

Following standards require to validate if the tool used is tamper free (eg checksum of binary)

  1. ITSP 40006

Tool needs to be bootable

Following standards require the applications to run from a bootable device:

  1. ITSP 40006

Following Standards require to Destroy Disks with Bad Sectors

Following standards require to verify bad sectors for successful erasure or otherwise return failed:

  1. ITSP 40006

Overwrite with Random Values

Following Standards require PNRG Streams to overwrite

  1. Germany: CON.6

DOES NOT APPLY TO FOLLOWING STANDARDS

  1. NSA/CSS Policy Manual 9-12 as it is a destruction only standard

Additional Sources

  1. Canada: From RCMP TSSIT OPS-II to ITSP.40.006. Canada’s Data Sanitization Standards. Explained.
Knogle commented 2 days ago

I've gone through in depth, looks like a nice goal. I also have specific use cases for that.