Instructor: Data retention. 2 2
In this lesson, we are going to talk about data retention. 3 3
When we talk about data retention, it's really just talking 4 4
about a set of policies, procedures 5 5
and tools for managing the storage of persistent data. 6 6
Essentially, think about how long should I keep this thing? 7 7
Now, as an organization, 8 8
we may have legal requirements that bind us 9 9
to retain certain types of data 10 10
for a specified period of time 11 11
to meet compliance and e-discovery requirements. 12 12
For example, I mentioned Sarbanes-Oxley earlier. 13 13
If you work for an American company that is publicly traded 14 14
and has a value of at least $75 million, 15 15
they have data retention standards that are dictated by law. 16 16
They can't go and shred all their paperwork ahead of time. 17 17
They have to wait until the time runs out. 18 18
And that's what we're talking about here 19 19
with meeting compliance requirements. 20 20
Now, when we talk about data retention, 21 21
this is the process that an organization uses 22 22
to maintain the existence of 23 23
and control of certain data 24 24
in order to comply with business policies 25 25
and/or applicable laws and regulations. 26 26
So your data retention doesn't just have to be told 27 27
to you by law or regulation, 28 28
it can also be something you self-inflict 29 29
using your own business policies. 30 30
Now, whenever you're creating your own business policies 31 31
you should always include your legal counsel 32 32
when you're developing these data retention policies. 33 33
Why, because legal counsel knows the laws. 34 34
Legal counsel is another fancy word for lawyers. 35 35
You're going to make sure that the lawyers 36 36
for your company are involved in this process 37 37
because they know what the requirements are exactly 38 38
for Sarbanes-Oxley or HIPAA or GLBA 39 39
or any of the other laws out there. 40 40
And they'll say, "You need to keep this data for two years, 41 41
you need to keep that data for seven years, 42 42
this data you only need for three months." 43 43
And being able to tell you that is really helpful 44 44
as you're developing those policies. 45 45
Now, in addition to retaining the data, 46 46
you also sometimes will hear the word preservation of data. 47 47
And when I talk about data preservation, 48 48
this refers to information that's kept 49 49
for a specific purpose 50 50
outside of an organization's data retention policy. 51 51
For example, our data retention policy 52 52
at our company doesn't cover user data 53 53
specific on our website. 54 54
And what I mean by that is when you go to our website 55 55
and you take a course, 56 56
we actually know which lessons you finished 57 57
and we also know which quizzes you took 58 58
and what your score was on those. 59 59
That policy that we talk about there 60 60
isn't covered in data retention. 61 61
Instead, that's a separate policy 62 62
known as Data Preservation. 63 63
And this is just us knowing how long do we want 64 64
to keep an average customer's data? 65 65
And that's based on our storage size 66 66
our processing capabilities, and things like that. 67 67
Now, when you start trying to deal 68 68
with all this data retention stuff, 69 69
you have to have a way to backup 70 70
and archive the information, 71 71
and these tools are going to be used to help you 72 72
fulfill the requirements of data retention. 73 73
If I need to keep this thing for seven years, 74 74
it doesn't mean that it has to be seven years online, 75 75
where you can access it in a second. 76 76
We can have that offloaded 77 77
to a tape backup or an external drive 78 78
and then we can pull it if we have the need for it 79 79
inside of a lawsuit or some other regulatory finding. 80 80
Now, there are two types of retention. 81 81
We have both short term and long term retention. 82 82
When I'm talking about short term retention, 83 83
this is determined 84 84
by how often the youngest media sets are overwritten. 85 85
This is essentially your online data. 86 86
So I have a server, I do backups of it every single night. 87 87
Now, when I run out of space, 88 88
I start overwriting the old backups with new backups, 89 89
whatever that time period is, 90 90
that is your short term retention. 91 91
So for most companies, that might be seven days, 92 92
it might be two weeks, it might be a month. 93 93
It's usually not very long. 94 94
Now, when I talk about long term retention, 95 95
this is any data that's moved 96 96
to an archive storage to prevent being overwritten. 97 97
So, if I have to keep this data for seven years 98 98
for instance, by law, 99 99
and my backups are only done every seven days 100 100
they start rewriting that's my short term, 101 101
then within seven days, I need to copy that data 102 102
off into some kind of long term storage. 103 103
That could be as simple as putting those documents out, 104 104
putting 'em in a filing cabinet. 105 105
It could be backing them up to a tape 106 106
and putting that into a filing cabinet. 107 107
It could be putting it off 108 108
to an offsite glacier storage inside the cloud. 109 109
There are lots of different ways you can do this 110 110
but the main term here that you have to think about is, 111 111
is it short term or is it long term? 112 112
If you need it for the long term, 113 113
you're going to have to archive it off your system 114 114
so you always have it available. 115 115
Now, when it comes to backups 116 116
how do you know how much to backup? 117 117
Well, all of your backups are going to take up 118 118
valuable storage space. 119 119
Now, can you backup everything all the time? 120 120
No, because you simply won't have enough time, money 121 121
or space for all of that. 122 122
So instead, you have to start thinking 123 123
through what will be backed up. 124 124
And the first thing you're going to backup 125 125
is everything you're legally required, 126 126
then you're going to backup what you need to 127 127
based on policies or based on operations. 128 128
Now, in addition to being able to do local backups 129 129
to things like tapes or external drives, 130 130
you can also backup to the cloud 131 131
and that can give you unlimited storage, 132 132
but you still aren't unlimited 133 133
because you have to pay for that 134 134
and your budget may not allow you to do unlimited storage. 135 135
And so again, you're going to have to be picky 136 136
and choosy of what you can backup 137 137
and how much it's going to cost you. 138 138
Now, when you try to figure all this out, 139 139
you're going to do this based on your business continuity plan. 140 140
Now, as you do your business continuity planning, 141 141
you need to define your recovery point objective, your RPO, 142 142
and we've talked about this term before. 143 143
Then that recovery point objective 144 144
will drive the recovery window and your backup plans. 145 145
Just a reminder, 146 146
when we talk about a recovery point objective, what is that? 147 147
The recovery point objective is what point 148 148
in time you need to be able to restore from backup. 149 149
So if I can afford to lose a day's worth of data, 150 150
my recovery point objective would be 24 hours. 151 151
If I can afford to lose five minutes of data, 152 152
my recovery point objective is five minutes. 153 153
Based on that recovery point objective, 154 154
you're going to be budgeted 155 155
and funded and design your systems around that, 156 156
including what your recovery window should be 157 157
and your backup plans. 158 158
Now, why is the RPO so important? 159 159
Well, the RPO is so important because it's going to help 160 160
drive the recovery window or the redundancies decisions 161 161
you've made inside your business, 162 162
and these redundancy decisions 163 163
and those recovery windows are going to end up 164 164
driving what that retention policy is going to look like 165 165
because it's going to be based on them. 166 166
Now, all of your data, at the end of its life, 167 167
has to be destroyed. 168 168
And what are you going to do to destroy it? 169 169
Are you just going to format the drive? 170 170
Are you going to throw it away? 171 171
Well, no, you have to make sure you securely dispose of it. 172 172
And so the data has to be securely disposed 173 173
once you reach the end of that retention period, 174 174
once it expires. 175 175
Now you can do this if it's paper, it's really easy. 176 176
You take out your paper 177 177
and you shred it, or you burn it or something like that. 178 178
But that's not going to solve all of your problems, 179 179
because we have hard drives too. 180 180
And hard drives can't necessarily just be shredded 181 181
very easily through a shredder like this at your office. 182 182
So some people actually physically destroy it. 183 183
They'll take a drill and go right through the platter. 184 184
Or you might have people who actually go 185 185
and pay to have somebody shred the hard drives. 186 186
There are machines that can shred hard drives. 187 187
Now they're expensive, so you'll have to take it 188 188
to a third party company who specializes in this usually, 189 189
but they do exist. 190 190
Now, there are lots of different ways to do secure disposal 191 191
and we've already talked a lot about that 192 192
back in the forensic section of this course. 193 193
So if you want to review that, please go back 194 194
to the forensic section and rewatch that video.