1 1 00:00:00,180 --> 00:00:01,710 Data retention. 2 2 00:00:01,710 --> 00:00:04,623 In this lesson, we are going to talk about data retention. 3 3 00:00:04,623 --> 00:00:07,320 When we talk about data retention, it's really just talking 4 4 00:00:07,320 --> 00:00:09,210 about a set of policies, procedures 5 5 00:00:09,210 --> 00:00:12,930 and tools for managing the storage of persistent data. 6 6 00:00:12,930 --> 00:00:16,110 Essentially, think about how long should I keep this thing? 7 7 00:00:16,110 --> 00:00:17,490 Now, as an organization, 8 8 00:00:17,490 --> 00:00:20,190 we may have legal requirements that bind us 9 9 00:00:20,190 --> 00:00:21,750 to retain certain types of data 10 10 00:00:21,750 --> 00:00:23,460 for a specified period of time 11 11 00:00:23,460 --> 00:00:26,190 to meet compliance and e-discovery requirements. 12 12 00:00:26,190 --> 00:00:29,070 For example, I mentioned Sarbanes-Oxley earlier. 13 13 00:00:29,070 --> 00:00:31,800 If you work for an American company that is publicly traded 14 14 00:00:31,800 --> 00:00:34,410 and has a value of at least $75 million, 15 15 00:00:34,410 --> 00:00:37,950 they have data retention standards that are dictated by law. 16 16 00:00:37,950 --> 00:00:40,350 They can't go and shred all their paperwork ahead of time. 17 17 00:00:40,350 --> 00:00:42,630 They have to wait until the time runs out. 18 18 00:00:42,630 --> 00:00:43,620 And that's what we're talking about here 19 19 00:00:43,620 --> 00:00:45,660 with meeting compliance requirements. 20 20 00:00:45,660 --> 00:00:47,400 Now, when we talk about data retention, 21 21 00:00:47,400 --> 00:00:49,890 this is the process that an organization uses 22 22 00:00:49,890 --> 00:00:51,420 to maintain the existence of 23 23 00:00:51,420 --> 00:00:53,130 and control of certain data 24 24 00:00:53,130 --> 00:00:55,140 in order to comply with business policies 25 25 00:00:55,140 --> 00:00:57,960 and/or applicable laws and regulations. 26 26 00:00:57,960 --> 00:01:00,030 So your data retention doesn't just have to be told 27 27 00:01:00,030 --> 00:01:02,070 to you by law or regulation, 28 28 00:01:02,070 --> 00:01:04,290 it can also be something you self-inflict 29 29 00:01:04,290 --> 00:01:06,330 using your own business policies. 30 30 00:01:06,330 --> 00:01:08,820 Now, whenever you're creating your own business policies 31 31 00:01:08,820 --> 00:01:11,220 you should always include your legal counsel 32 32 00:01:11,220 --> 00:01:13,950 when you're developing these data retention policies. 33 33 00:01:13,950 --> 00:01:16,800 Why, because legal counsel knows the laws. 34 34 00:01:16,800 --> 00:01:19,410 Legal counsel is another fancy word for lawyers. 35 35 00:01:19,410 --> 00:01:20,820 You're going to make sure that the lawyers 36 36 00:01:20,820 --> 00:01:23,070 for your company are involved in this process 37 37 00:01:23,070 --> 00:01:25,260 because they know what the requirements are exactly 38 38 00:01:25,260 --> 00:01:28,290 for Sarbanes-Oxley or HIPAA or GLBA 39 39 00:01:28,290 --> 00:01:29,790 or any of the other laws out there. 40 40 00:01:29,790 --> 00:01:32,520 And they'll say, "You need to keep this data for two years, 41 41 00:01:32,520 --> 00:01:34,050 you need to keep that data for seven years, 42 42 00:01:34,050 --> 00:01:35,850 this data you only need for three months." 43 43 00:01:35,850 --> 00:01:37,920 And being able to tell you that is really helpful 44 44 00:01:37,920 --> 00:01:39,600 as you're developing those policies. 45 45 00:01:39,600 --> 00:01:41,580 Now, in addition to retaining the data, 46 46 00:01:41,580 --> 00:01:44,700 you also sometimes will hear the word preservation of data. 47 47 00:01:44,700 --> 00:01:46,470 And when I talk about data preservation, 48 48 00:01:46,470 --> 00:01:48,240 this refers to information that's kept 49 49 00:01:48,240 --> 00:01:49,770 for a specific purpose 50 50 00:01:49,770 --> 00:01:52,920 outside of an organization's data retention policy. 51 51 00:01:52,920 --> 00:01:55,080 For example, our data retention policy 52 52 00:01:55,080 --> 00:01:57,600 at our company doesn't cover user data 53 53 00:01:57,600 --> 00:01:59,250 specific on our website. 54 54 00:01:59,250 --> 00:02:00,990 And what I mean by that is when you go to our website 55 55 00:02:00,990 --> 00:02:02,070 and you take a course, 56 56 00:02:02,070 --> 00:02:03,960 we actually know which lessons you finished 57 57 00:02:03,960 --> 00:02:05,850 and we also know which quizzes you took 58 58 00:02:05,850 --> 00:02:07,770 and what your score was on those. 59 59 00:02:07,770 --> 00:02:09,780 That policy that we talk about there 60 60 00:02:09,780 --> 00:02:11,490 isn't covered in data retention. 61 61 00:02:11,490 --> 00:02:13,710 Instead, that's a separate policy 62 62 00:02:13,710 --> 00:02:15,570 known as Data Preservation. 63 63 00:02:15,570 --> 00:02:17,790 And this is just us knowing how long do we want 64 64 00:02:17,790 --> 00:02:19,500 to keep an average customer's data? 65 65 00:02:19,500 --> 00:02:21,360 And that's based on our storage size 66 66 00:02:21,360 --> 00:02:24,120 our processing capabilities, and things like that. 67 67 00:02:24,120 --> 00:02:25,470 Now, when you start trying to deal 68 68 00:02:25,470 --> 00:02:26,970 with all this data retention stuff, 69 69 00:02:26,970 --> 00:02:28,530 you have to have a way to backup 70 70 00:02:28,530 --> 00:02:30,150 and archive the information, 71 71 00:02:30,150 --> 00:02:31,860 and these tools are going to be used to help you 72 72 00:02:31,860 --> 00:02:34,320 fulfill the requirements of data retention. 73 73 00:02:34,320 --> 00:02:36,450 If I need to keep this thing for seven years, 74 74 00:02:36,450 --> 00:02:39,150 it doesn't mean that it has to be seven years online, 75 75 00:02:39,150 --> 00:02:41,070 where you can access it in a second. 76 76 00:02:41,070 --> 00:02:42,540 We can have that offloaded 77 77 00:02:42,540 --> 00:02:44,880 to a tape backup or an external drive 78 78 00:02:44,880 --> 00:02:47,070 and then we can pull it if we have the need for it 79 79 00:02:47,070 --> 00:02:50,190 inside of a lawsuit or some other regulatory finding. 80 80 00:02:50,190 --> 00:02:52,020 Now, there are two types of retention. 81 81 00:02:52,020 --> 00:02:54,960 We have both short term and long term retention. 82 82 00:02:54,960 --> 00:02:56,820 When I'm talking about short term retention, 83 83 00:02:56,820 --> 00:02:57,653 this is determined 84 84 00:02:57,653 --> 00:03:01,140 by how often the youngest media sets are overwritten. 85 85 00:03:01,140 --> 00:03:03,570 This is essentially your online data. 86 86 00:03:03,570 --> 00:03:07,680 So I have a server, I do backups of it every single night. 87 87 00:03:07,680 --> 00:03:09,360 Now, when I run out of space, 88 88 00:03:09,360 --> 00:03:12,570 I start overwriting the old backups with new backups, 89 89 00:03:12,570 --> 00:03:14,190 whatever that time period is, 90 90 00:03:14,190 --> 00:03:16,110 that is your short term retention. 91 91 00:03:16,110 --> 00:03:18,750 So for most companies, that might be seven days, 92 92 00:03:18,750 --> 00:03:21,420 it might be two weeks, it might be a month. 93 93 00:03:21,420 --> 00:03:22,800 It's usually not very long. 94 94 00:03:22,800 --> 00:03:24,990 Now, when I talk about long term retention, 95 95 00:03:24,990 --> 00:03:26,520 this is any data that's moved 96 96 00:03:26,520 --> 00:03:29,190 to an archive storage to prevent being overwritten. 97 97 00:03:29,190 --> 00:03:31,920 So, if I have to keep this data for seven years 98 98 00:03:31,920 --> 00:03:33,300 for instance, by law, 99 99 00:03:33,300 --> 00:03:35,520 and my backups are only done every seven days 100 100 00:03:35,520 --> 00:03:37,530 they start rewriting that's my short term, 101 101 00:03:37,530 --> 00:03:39,930 then within seven days, I need to copy that data 102 102 00:03:39,930 --> 00:03:42,270 off into some kind of long term storage. 103 103 00:03:42,270 --> 00:03:45,180 That could be as simple as putting those documents out, 104 104 00:03:45,180 --> 00:03:46,530 putting 'em in a filing cabinet. 105 105 00:03:46,530 --> 00:03:48,060 It could be backing them up to a tape 106 106 00:03:48,060 --> 00:03:49,890 and putting that into a filing cabinet. 107 107 00:03:49,890 --> 00:03:50,760 It could be putting it off 108 108 00:03:50,760 --> 00:03:53,850 to an offsite glacier storage inside the cloud. 109 109 00:03:53,850 --> 00:03:55,560 There are lots of different ways you can do this 110 110 00:03:55,560 --> 00:03:57,720 but the main term here that you have to think about is, 111 111 00:03:57,720 --> 00:04:00,150 is it short term or is it long term? 112 112 00:04:00,150 --> 00:04:01,470 If you need it for the long term, 113 113 00:04:01,470 --> 00:04:03,750 you're going to have to archive it off your system 114 114 00:04:03,750 --> 00:04:05,610 so you always have it available. 115 115 00:04:05,610 --> 00:04:07,260 Now, when it comes to backups 116 116 00:04:07,260 --> 00:04:09,270 how do you know how much to backup? 117 117 00:04:09,270 --> 00:04:11,190 Well, all of your backups are going to take up 118 118 00:04:11,190 --> 00:04:12,690 valuable storage space. 119 119 00:04:12,690 --> 00:04:15,090 Now, can you backup everything all the time? 120 120 00:04:15,090 --> 00:04:18,240 No, because you simply won't have enough time, money 121 121 00:04:18,240 --> 00:04:19,710 or space for all of that. 122 122 00:04:19,710 --> 00:04:21,480 So instead, you have to start thinking 123 123 00:04:21,480 --> 00:04:23,040 through what will be backed up. 124 124 00:04:23,040 --> 00:04:24,330 And the first thing you're going to backup 125 125 00:04:24,330 --> 00:04:26,400 is everything you're legally required, 126 126 00:04:26,400 --> 00:04:28,710 then you're going to backup what you need to 127 127 00:04:28,710 --> 00:04:31,560 based on policies or based on operations. 128 128 00:04:31,560 --> 00:04:33,480 Now, in addition to being able to do local backups 129 129 00:04:33,480 --> 00:04:35,760 to things like tapes or external drives, 130 130 00:04:35,760 --> 00:04:37,260 you can also backup to the cloud 131 131 00:04:37,260 --> 00:04:39,450 and that can give you unlimited storage, 132 132 00:04:39,450 --> 00:04:41,250 but you still aren't unlimited 133 133 00:04:41,250 --> 00:04:42,540 because you have to pay for that 134 134 00:04:42,540 --> 00:04:45,540 and your budget may not allow you to do unlimited storage. 135 135 00:04:45,540 --> 00:04:47,580 And so again, you're going to have to be picky 136 136 00:04:47,580 --> 00:04:49,230 and choosy of what you can backup 137 137 00:04:49,230 --> 00:04:51,150 and how much it's going to cost you. 138 138 00:04:51,150 --> 00:04:52,710 Now, when you try to figure all this out, 139 139 00:04:52,710 --> 00:04:55,860 you're going to do this based on your business continuity plan. 140 140 00:04:55,860 --> 00:04:57,870 Now, as you do your business continuity planning, 141 141 00:04:57,870 --> 00:05:01,260 you need to define your recovery point objective, your RPO, 142 142 00:05:01,260 --> 00:05:03,420 and we've talked about this term before. 143 143 00:05:03,420 --> 00:05:05,280 Then that recovery point objective 144 144 00:05:05,280 --> 00:05:08,250 will drive the recovery window and your backup plans. 145 145 00:05:08,250 --> 00:05:09,083 Just a reminder, 146 146 00:05:09,083 --> 00:05:12,180 when we talk about a recovery point objective, what is that? 147 147 00:05:12,180 --> 00:05:14,790 The recovery point objective is what point 148 148 00:05:14,790 --> 00:05:17,610 in time you need to be able to restore from backup. 149 149 00:05:17,610 --> 00:05:20,610 So if I can afford to lose a day's worth of data, 150 150 00:05:20,610 --> 00:05:23,430 my recovery point objective would be 24 hours. 151 151 00:05:23,430 --> 00:05:25,830 If I can afford to lose five minutes of data, 152 152 00:05:25,830 --> 00:05:28,380 my recovery point objective is five minutes. 153 153 00:05:28,380 --> 00:05:30,060 Based on that recovery point objective, 154 154 00:05:30,060 --> 00:05:31,080 you're going to be budgeted 155 155 00:05:31,080 --> 00:05:33,720 and funded and design your systems around that, 156 156 00:05:33,720 --> 00:05:35,820 including what your recovery window should be 157 157 00:05:35,820 --> 00:05:37,350 and your backup plans. 158 158 00:05:37,350 --> 00:05:39,750 Now, why is the RPO so important? 159 159 00:05:39,750 --> 00:05:42,120 Well, the RPO is so important because it's going to help 160 160 00:05:42,120 --> 00:05:45,090 drive the recovery window or the redundancies decisions 161 161 00:05:45,090 --> 00:05:46,710 you've made inside your business, 162 162 00:05:46,710 --> 00:05:48,270 and these redundancy decisions 163 163 00:05:48,270 --> 00:05:51,000 and those recovery windows are going to end up 164 164 00:05:51,000 --> 00:05:53,880 driving what that retention policy is going to look like 165 165 00:05:53,880 --> 00:05:56,040 because it's going to be based on them. 166 166 00:05:56,040 --> 00:05:58,650 Now, all of your data, at the end of its life, 167 167 00:05:58,650 --> 00:06:00,120 has to be destroyed. 168 168 00:06:00,120 --> 00:06:01,590 And what are you going to do to destroy it? 169 169 00:06:01,590 --> 00:06:03,270 Are you just going to format the drive? 170 170 00:06:03,270 --> 00:06:04,590 Are you going to throw it away? 171 171 00:06:04,590 --> 00:06:07,680 Well, no, you have to make sure you securely dispose of it. 172 172 00:06:07,680 --> 00:06:09,780 And so the data has to be securely disposed 173 173 00:06:09,780 --> 00:06:12,120 once you reach the end of that retention period, 174 174 00:06:12,120 --> 00:06:13,680 once it expires. 175 175 00:06:13,680 --> 00:06:15,930 Now you can do this if it's paper, it's really easy. 176 176 00:06:15,930 --> 00:06:16,860 You take out your paper 177 177 00:06:16,860 --> 00:06:19,830 and you shred it, or you burn it or something like that. 178 178 00:06:19,830 --> 00:06:22,050 But that's not going to solve all of your problems, 179 179 00:06:22,050 --> 00:06:24,090 because we have hard drives too. 180 180 00:06:24,090 --> 00:06:26,310 And hard drives can't necessarily just be shredded 181 181 00:06:26,310 --> 00:06:28,620 very easily through a shredder like this at your office. 182 182 00:06:28,620 --> 00:06:30,720 So some people actually physically destroy it. 183 183 00:06:30,720 --> 00:06:32,970 They'll take a drill and go right through the platter. 184 184 00:06:32,970 --> 00:06:35,220 Or you might have people who actually go 185 185 00:06:35,220 --> 00:06:37,560 and pay to have somebody shred the hard drives. 186 186 00:06:37,560 --> 00:06:39,810 There are machines that can shred hard drives. 187 187 00:06:39,810 --> 00:06:41,190 Now they're expensive, so you'll have to take it 188 188 00:06:41,190 --> 00:06:43,800 to a third party company who specializes in this usually, 189 189 00:06:43,800 --> 00:06:45,150 but they do exist. 190 190 00:06:45,150 --> 00:06:47,910 Now, there are lots of different ways to do secure disposal 191 191 00:06:47,910 --> 00:06:49,410 and we've already talked a lot about that 192 192 00:06:49,410 --> 00:06:51,390 back in the forensic section of this course. 193 193 00:06:51,390 --> 00:06:53,280 So if you want to review that, please go back 194 194 00:06:53,280 --> 00:06:55,743 to the forensic section and rewatch that video.