## 5 Discussion
### Vulnerabilities Mitigation
#### 5.2.5 PHYS, PORT, STAT: Disposals  
When disposing of sensitive data, one must be aware of the possibility of an adversary searching the dustbin, which is known as dumpster diving, a social engineering attack. With this method, the attacker may access any object the company discards, such as equipment and documents. There may be sensitive data among this disposed-of material, such as employees' noted passwords or customers' data. In that case, the malicious actor will have more information to conduct the attack. It is noteworthy that since the California v. [PERSON] case in 1988, the legality of the warrantless search-and-seizure of garbage left in public areas has been established [80]. Because of that, for one more layer of security against data breaches, companies should keep their waste bins locked in private areas. As an additional countermeasure to this approach, a company should, at the end of the data life cycle, carry out an adequate disposal of information. To accomplish that, Data Classification and Asset Disposal Policies should be implemented and publicized to raise employees' awareness. To aid suitable editing of these and other policies, several esteemed security organizations provide policy templates, such as the SANS Institute (sans.org/information-security-policy/ accessed on 7 April 2024) and CIS (cisecurity.org/ accessed on 7 April 2024). Before disposal, the media must be sanitized--that is, have its data rendered inaccessible for a given level of the attacker effort, depending on the classification of the data. Proper media-sanitization techniques are presented by NIST SP 800-88 [81] for different media types.For paper documents, for example, the standard states that they must be shredded in pieces small enough that there is reasonable assurance that the data cannot be reconstructed in proportion to the data confidentiality. To further hinder a malicious reconstruction, sensitive documents may be mixed with public paper in the shredder input. Regarding the size of the shredded pieces for each classification level, the German standard DIN 66399 [82] provides some valuable guidelines, some of which are summarized in Table 10.  
Similar disposal approaches should be deployed to digital devices, such as Hard Drives (HD), Solid-State Drives (SSD), flash drives, and CDs/DVDs. Despite physical destruction and shredding still being possible for these types of media, and it indeed being \begin{table}
\begin{tabular}{c c} \hline \hline
**Classification Level** & **Maximum Piece Width/Area** \\ \hline P-1 (least sensitive) & 2000 mm\({}^{2}\) (particle area) or 12 mm (strip width) \\ P-2 & 800 mm\({}^{2}\) (particle area) or 6 mm (strip width) \\ \hline P-3 & 320 mm\({}^{2}\) (particle area) or 2 mm (strip width) \\ P-4 & 160 mm\({}^{2}\) (cross-cut particle area) \\ P-5 & 30 mm\({}^{2}\) (cross-cut particle area) \\ P-6 & 10 mm\({}^{2}\) (cross-cut particle area) \\ P-7 (most sensitive) & 5 mm\({}^{2}\) (cross-cut particle area) \\ \hline \hline \end{tabular}
\end{table} 
Table 10: German DIN 66399 paper shredding sizes according to the data sensitivity. recommended for more sensitive cases, the nature of these devices allows for other erasure mechanisms, especially for the least sensitive data. It is known that simply deleting files via the operating system is not an effective way to purge data, as data carving techniques can retrieve said files [83]. Other techniques, such as zero filling, in which all data are overwritten with zeroes, are effective against commonly available data retrieval mechanisms, according to NIST SP 800-88. Additional filling rounds may be performed to increase security. Specifically for magnetic HDs, the degaussing technique may be used. It consists of applying a magnetic field to the hard drive, which changes the magnetic patterns on the device, consequently destroying the data. The degaussing approach will not be practical for SSDs, which are not magnetic. For this type of media, a secure way of dealing with data remanence is crypto-shredding, also named crypto-erasure.