Information storing and processing equipment includes all forms of personal computers,
organizers, mobile phones, smart cards, paper or other form, which is held for home working or
being transported away from the normal work location.
It may be appropriate to avoid the risk by discouraging certain employees from working off-site
or by restricting their use of portable IT equipment. (NL ISO/IEC, 2015)
11.7. Secure Disposal or Re-use of Equipment
All items of equipment containing storage media should be verified to ensure that any sensitive
data and licensed software has been removed or securely overwritten prior to disposal or reuse.
Equipment should be verified to ensure whether or not storage media is
contained prior to disposal or re-use.
Storage media containing confidential or copyrighted information should be
physically destroyed or the information should be destroyed, deleted or
overwritten using techniques to make the original information non-retrievable rather than
using the standard delete or format function.
Damaged equipment containing storage media may require a risk assessment to determine
whether the items should be physically destroyed rather than sent for repair or discarded.
Information can be compromised through careless disposal or re-use of equipment.
In addition to secure disk erasure, whole-disk encryption reduces the risk of disclosure of
confidential information when equipment is disposed of or redeployed, provided that:
a) the encryption process is sufficiently strong and covers the entire disk (including
slack space, swap files, etc.);
b) the encryption keys are long enough to resist brute force attacks;
c) the encryption keys are themselves kept confidential (e.g. never stored on the same
disk).
Techniques for securely overwriting storage media differ according to the storage media
technology. Overwriting tools should be reviewed to make sure that they are applicable to the
technology of the storage media. (NL ISO/IEC, 2015)
11.8. Unattended User Equipment
Users should ensure that unattended equipment has appropriate protection.
Lebanese National Security Policy Guidelines v1.7
Page
40 |