How to make sure azure postgresql db data is wiped following NIST-800-88 standards

Question

How do we make sure that the data in our db is wiped according to these standards, both manually and in backups which are deleted?

Answer 1

Hi @Benjamin Rosand

Thanks for the Question and using Microsoft Q&A

As per my understanding you would like to know how to ensure that the data in our database is wiped according to the specified standards, both manually and in deleted backups.

Manual Data Wiping

Clear: Use logical techniques to sanitize data in all user-addressable storage locations. This can be done by rewriting with a new value or using a menu option to reset the device to the factory state.

Purge: Apply physical or logical techniques that render target data recovery infeasible using state-of-the-art laboratory techniques. This can include degaussing for magnetic media or multi-pin punching for solid-state media.

Destroy: Physically destroy the storage media to make data recovery infeasible. This can be done using approved standard operating procedures that meet NIST SP-800-88 guidelines.

Backup Data Wiping

Identify Backup Locations: Ensure you know where all backups are stored, including offsite and cloud locations.

Apply Data Wiping Techniques: Use the same clear, purge, and destroy techniques on backup storage media as you would on primary storage.

Verify Deletion: Ensure that backup data is completely wiped and cannot be recovered. This may involve using specialized software tools that comply with NIST-800-88 standards.

Please go through these Documentations that might help you:

https://learn.microsoft.com/en-us/compliance/assurance/assurance-data-bearing-device-destruction

https://destroydrive.com/blog/data-wiping-1-pass-vs-3-pass-vs-7-pass-which-methodis-best/

https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-88r1.pdf

Hope this helps. Do let us know if you any further queries.