Which of the following is prevented by proper data sanitization?

Proper data sanitization is a process to irreversibly remove or destroy data stored on a

memory device (e.g., hard drives, SSDs) or in reusable media to make it

unrecoverable. Its primary goal is to protect the confidentiality of information.

Therefore, it directly prevents hackers or any unauthorized individuals from obtaining

residual data from used, discarded, or resold hard drives.

· B. Devices reaching end-of-life and losing support: Data sanitization is a

procedure often performed when devices reach end-of-life, but it doesn't prevent the

end-of-life status or loss of support itself. This is a matter of hardware lifecycle.

· C. Disclosure of sensitive data through incorrect classification: Incorrect data

classification can lead to improper handling and subsequent disclosure. While

sanitization is applied based on classification, sanitization itself doesn't prevent the act

of misclassification.

· D. Incorrect inventory data leading to a laptop shortage: This is an issue related to

asset management and inventory control, not directly addressed or prevented by data

sanitization processes.

1. National Institute of Standards and Technology (NIST) Special Publication 800-88

Rev. 1, "Guidelines for Media Sanitization."

o URL: https://doi.org/10.6028/NIST.SP.800-88r1

o Specifics: Section 2.3, "Purpose/Scope," states: "The purpose of this document is to

provide guidance for sanitizing electronic media." Section 1, "Introduction," discusses

that sanitization is performed to prevent data recovery. Table 1 outlines the relationship

between information confidentiality and sanitization. Specifically, page 7 (PDF page 14)

defines sanitization as "a process to render access to Target Data on the media

infeasible for a given level of effort." This directly supports option A.

2. IEEE 2883-2022 - IEEE Standard for Sanitizing Storage.

o URL: While the full standard typically requires purchase, summaries and abstracts

often reinforce the core purpose. A general search for the standard's purpose would

confirm its focus on rendering data unrecoverable. For instance, the abstract often

mentions preventing unauthorized access to data. (Example:

https://standards.ieee.org/ieee/2883/7028/ - abstract usually available)

o Specifics: The standard focuses on methods to ensure data is not recoverable from

storage devices, aligning with preventing hackers from accessing data on used drives.

3. Microsoft Azure Documentation - Data security and encryption best practices

(While a vendor, their security documentation is generally robust and aligned with

standards).

o URL: https://learn.microsoft.com/en-us/azure/security/fundamentals/data-security

(This is a general link, specific documentation on data destruction or media

sanitization would be more targeted). More specifically, documentation on "Data

destruction in Azure" or similar topics.

o Specifics: Microsoft's descriptions of data destruction and sanitization in their

services emphasize making data unrecoverable to protect against unauthorized access

when hardware is decommissioned, which directly supports preventing hackers from

obtaining data. For instance, see the section on "Data destruction" in their compliance

offerings.

(Note on options B, C, D): These options describe issues related to IT governance,

data governance, and asset management respectively, which are distinct from the

technical process and primary goal of data sanitization as defined by NIST and IEEE.