<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-secure-data-deletion
description: >-
  Implement secure data deletion and sanitization procedures aligned with
  NIST SP 800-88 for storage media, cloud resources, databases, and
  application data to ensure irrecoverable destruction of sensitive information.
domain: cybersecurity
subdomain: data-security
tags:
  - secure-deletion
  - data-sanitization
  - nist-800-88
  - cryptographic-erasure
  - data-retention
  - gdpr
  - right-to-erasure
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1485"]
---

# Implementing Secure Data Deletion

## Overview

Secure data deletion ensures sensitive information cannot be recovered after
its retention period expires or upon request (GDPR Art. 17 right to erasure).
NIST SP 800-88 defines three sanitization levels — Clear, Purge, and Destroy —
each appropriate for different media types and reuse scenarios. This skill
covers sanitization method selection, cryptographic erasure for encrypted
volumes, database record deletion, cloud resource cleanup, and verification
procedures.

Mode: `[MODE: ARCHITECT]` — Data lifecycle and destruction design.

## Prerequisites

- Data retention policy with defined retention periods
- Asset inventory with media types and encryption status
- NIST SP 800-88 sanitization decision matrix
- Verification tools for sanitization confirmation

## Key Concepts

### NIST SP 800-88 Sanitization Levels

| Level | Method | Recovery Resistance | Use Case |
|-------|--------|-------------------|----------|
| Clear | Overwrite, factory reset | Resists keyboard attack | Internal reuse |
| Purge | Crypto-erase, block erase, degauss | Resists laboratory attack | External disposal |
| Destroy | Shred, disintegrate, incinerate | Physically destroyed | End of life |

### Media-Specific Methods

```
Sanitization by media type:
├── HDD (magnetic)
│   ├── Clear: Single-pass overwrite (zeros or random)
│   ├── Purge: Degaussing or 3-pass overwrite
│   └── Destroy: Shred (NSA/CSS EPL-listed shredder)
├── SSD / NVMe
│   ├── Clear: ATA Secure Erase
│   ├── Purge: Cryptographic erase or vendor sanitize command
│   └── Destroy: Shred or disintegrate
├── Cloud storage
│   ├── Clear: Delete + verify via API
│   ├── Purge: Cryptographic erasure (destroy KMS key)
│   └── Destroy: N/A (provider responsibility)
├── Database records
│   ├── Clear: DELETE with verification query
│   ├── Purge: DELETE + VACUUM FULL + WAL truncation
│   └── Verify: Row count and sample check
└── Application data
    ├── Cache: Flush + restart
    ├── Logs: Secure deletion per retention policy
    └── Backups: Encrypted backup key destruction
```

### Scanning CLI

```bash
# Audit data retention compliance
node scripts/agent.js --action audit --input /tmp/data_inventory.json \
  --retention-days 365 --output /tmp/retention_audit.json

# Generate deletion plan for expired data
node scripts/agent.js --action plan --input /tmp/retention_audit.json \
  --output /tmp/deletion_plan.json

# Verify secure deletion
node scripts/agent.js --action verify --input /tmp/deletion_plan.json \
  --output /tmp/deletion_verification.json
```

## Workflow

### Step 1: Identify Expired Data

```bash
node scripts/agent.js --action audit --input /tmp/data_inventory.json \
  --retention-days 365
```

### Step 2: Generate Deletion Plan

```bash
node scripts/agent.js --action plan --input /tmp/retention_audit.json
```

### Step 3: Execute Secure Deletion

Apply appropriate sanitization method based on media type and sensitivity.

### Step 4: Verify and Document

```bash
node scripts/agent.js --action verify --input /tmp/deletion_plan.json
```

## Detection

```yaml
title: Secure Data Deletion Detection
id: 186f4f90-a478-4576-8283-fa1ce0f339c1
status: experimental
description: Detects suspicious activity related to implementing secure data deletion techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1485
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] Retention policy defined for all data classifications
- [ ] Sanitization method mapped to media type and sensitivity
- [ ] Cryptographic erasure used for encrypted cloud volumes
- [ ] Database deletion verified with row count checks
- [ ] Certificate of destruction obtained for physical media
- [ ] Backup copies included in deletion scope
- [ ] GDPR erasure requests processed within 30-day deadline

## References

- [NIST SP 800-88 Rev. 1 — Media Sanitization](https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final)
- [GDPR Article 17 — Right to Erasure](https://gdpr-info.eu/art-17-gdpr/)
- [DoD 5220.22-M — Clearing and Sanitization Matrix](https://www.esd.whs.mil/)
- [NSA/CSS EPL for Media Destruction](https://www.nsa.gov/Resources/Media-Destruction-Guidance/)
