CND (312-38) Network Defense Simulation

Expert Analysis

1. What is happening in the network

The network defense team is executing the final phase of the data lifecycle: Secure Disposal. The NAS array contains sensitive network telemetry. If this data is not properly sanitized before leaving the facility, threat actors or unscrupulous vendors could recover old PCAPs, exposing historical network topologies, legacy internal IP schemes, or plaintext credentials that were captured in the clear.

2. Identify attack or behavior

This scenario defends against Data Remanence Attacks. When files are standardly deleted or a drive is quickly formatted, the actual binary data remains on the disk platters. Attackers use forensic recovery tools to reconstruct this residual data.

3. Why correct answer is correct

B. Wiping is correct. In the context of CND and media sanitization, "Wiping" (often referring to secure wiping or cryptographic wiping) is a logical purging technique. Unlike simple overwriting, secure wiping uses specialized software and multiple algorithmic passes (or cryptographic erasure) to ensure data recovery is infeasible even using advanced laboratory techniques, satisfying the requirement to "purge" data while keeping the hardware operational for return.

4. Why others are wrong

• A. Degaussing: While it is a purging technique, it is a physical method using strong magnetic fields. It destroys the magnetic servos on modern hard drives, rendering them permanently inoperable and violating the constraint to return intact media to the vendor.
• C. Incineration: This is a Destruction technique, not a Purging technique. It physically obliterates the media.
• D. Overwriting: Simple overwriting (like a single pass of zeroes) is classified by NIST as a Clearing technique, not a Purging technique. It protects against basic keyboard attacks but may not withstand advanced laboratory recovery techniques on certain older magnetic media.

5. Defensive action

Implement a strict Data Disposition Policy aligned with NIST SP 800-88. Ensure all network sensors, firewalls, and logging servers undergo proper cryptographic wiping or multi-pass secure wiping before being repurposed, sold, or returned to vendors.

6. MINI LESSON: Media Sanitization Definitions

• Clear: Logical techniques to sanitize data (e.g., standard overwriting). Protects against simple non-invasive data recovery techniques.
• Purge: Physical or logical techniques (e.g., Degaussing, Secure Wiping/Cryptographic Erase) that render target data recovery infeasible using state-of-the-art laboratory techniques.
• Destroy: Renders target data recovery infeasible and results in the subsequent inability to use the media (e.g., Incineration, Shredding, Pulverizing).