5.2.2. Monitoring and Disposal

💡 First Principle: Assets require monitoring throughout their operational life and secure disposal at end of life. Neglecting either creates risk — unmonitored assets drift from security baselines, and improperly disposed assets leak sensitive data. The asset lifecycle doesn't end when a device is powered off.

Monitoring — continuous tracking of asset status: patch levels, configuration compliance, utilization, and anomalous behavior. Agents, scanners, and network monitoring tools provide visibility. Key monitoring concerns include unauthorized software installations, end-of-life software still running in production, and assets approaching warranty expiration. Monitoring should also track asset location — especially for mobile devices and laptops that travel outside the facility.

Asset disposal/decommissioning — secure removal of assets from the environment. The goal is ensuring that no sensitive data can be recovered from disposed assets:

• Sanitization — removing all data from storage media using methods appropriate to the data classification. Higher classifications require more thorough methods.
• Overwriting — writing patterns over existing data (one or more passes). Sufficient for most purposes but may not destroy data in bad sectors or wear-leveled flash storage.
• Degaussing — using powerful magnetic fields to erase magnetic media. Destroys the data and usually the media itself. Only works on magnetic storage — completely ineffective on SSDs, flash drives, and optical media.
• Destruction — physical destruction (shredding, incineration, pulverizing) is the most certain method. Required for the highest classification levels and when other methods aren't verifiable.
• Cryptographic erasure — destroying the encryption keys for encrypted storage, rendering the data unrecoverable. Fast and effective for self-encrypting drives and encrypted storage volumes.
• Certification — documenting that sanitization was performed according to standards, including the method used, date, and responsible individual. Creates an auditable trail for compliance.

⚠️ Exam Trap: Degaussing works on magnetic media only — NOT on SSDs, flash drives, or optical media. If a question asks about securely disposing of an SSD, the answer is physical destruction or cryptographic erasure, not degaussing.