Is Post-Breach Data Sanitization Technically Verifiable?

[johny899]

Think about it this way: a data breach occurs, people panic, and someone thinks they can just delete everything – is that even possible? At this point, I always have to stop myself – deleting information is not the same thing as ensuring it has been deleted.

Why Proof Matters​

When a data breach occurs, trust will be compromised. Customers, regulators, and partners alike all want to know what the outcome was. Simply stating "we deleted everything" won't be good enough anymore. We all need assurance that hackers can't come back and take advantage of it later.

How Teams Clean Up After a Breach​

The majority of businesses will perform several different types of activities to clean up their data after a data breach. The following are some examples of these types of activities:

• Overwriting the existing data so the older files are no longer accessible
• Encrypting the data that was stored in the breach and destroying the access keys
• Deleting any backups in the cloud associated with the breach
• Conducting follow-up security assessments of the affected systems with security tools

I once witnessed a group of employees thoroughly erasing the servers after a security breach and, inevitably, everyone asked, "How do we know it worked?"

What's Going on Here?​

The truth is getting to perfect evidence is very difficult to do. Copies of documents might stay on logs, backups, or be lost to a system. Additional confusion is created by how fast data is transferred to cloud providers. Even the best verification products may miss something that is small.

How Can You Verify Evidence Technically?​

In general yes, but not fully! There are good indicators of technical verification through reports, records, and audit results. Sometimes you won't be able to prove 100 percent certainty. For example deleting images from your phone and checking the 'trash' folder and seeing if they were really gone.