2 cissp ® Official Study Guide Eighth Edition

707
Storage
Data is primarily stored on disk drives, and personnel periodically back up 
valuable data. When storing data, it’s important to ensure that it’s protected by adequate 
security controls based on its classification. This includes applying appropriate permissions 
to prevent unauthorized disclosure. Sensitive data should also be encrypted to protect it. 
Backups of sensitive information are stored in one location on-site, and a copy is stored at 
another location off-site. Physical security methods protect these backups against theft. 
Environmental controls protect the data against loss due to environmental corruption such 
as heat and humidity.
Usage
Usage refers to anytime data is in use or in transit over a network. When data is in 
use, it is in an unencrypted format. Application developers need to take steps to ensure that 
any sensitive data is flushed from memory after being used. Data in transit (transmitted 
over a network) requires protection based on the value of the data. Encrypting data before 
sending it provides this protection.
Archive
Data is sometimes archived to comply with laws or regulations requiring the 
retention of data. Additionally, valuable data is backed up as a basic security control to 
ensure that it is available even if access to the original data is lost. Archives and backups 
are often stored off-site. When transporting and storing this data, it’s important to provide 
the same level of protection applied during storage on-site. The level of protection is depen-
dent on the classification and value of the data.
Destruction or Purging
When data is no longer needed, it should be destroyed in such a 
way that it is not readable. Simply deleting files doesn’t delete them but instead marks them 
for deletion, so this isn’t a valid way to destroy data. Technicians and administrators use a 
variety of tools to remove all readable elements of files when necessary. These often over-
write the files or disks with patterns of 1s and 0s or use other methods to shred the files. 
When deleting sensitive data, many organizations require personnel to destroy the disk 
to ensure that data is not accessible. The National Institute of Standards and Technology 
(NIST) special publication (SP) SP 800-88r1, “Guidelines for Media Sanitization,” pro-
vides details on how to sanitize media. Additionally, Chapter 5 covers various methods of 
destroying and purging data.