In case of a security emergency, you can instantly prevent access to a FIPS drive or SED, even if power is not available to the storage system or the KMIP server.

Before you begin

If you are using a KMIP server that has no available power, the KMIP server must be configured with an easily destroyed authentication item (for example, a smart card or USB drive).
You must be a cluster administrator to perform this task.

Step

Perform emergency shredding of data on a FIPS drive or SED:

If…

Then…

Power is available to the storage system and you have time to take the storage system offline gracefully

If the storage system is configured as an HA pair, disable takeover.
Take all aggregates offline and delete them.
Set the privilege level to advanced:
set -privilege advanced
If the drive is in FIPS-compliance mode, set the FIPS authentication key ID for the node back to the default MSID:
storage encryption disk modify -disk * -fips-key-id 0x0
Halt the storage system.
Boot into maintenance mode.
Sanitize or destroy the disks:
- If you want to make the data on the disks inaccessible and still be able to reuse the disks, sanitize the disks:
  disk encrypt sanitize -all
- If you want to make the data on the disks inaccessible and you do not need to save the disks, destroy the disks:
  disk encrypt destroy disk_id1 disk_id2 …
The disk encrypt sanitize and disk encrypt destroy commands are reserved for maintenance mode only. These commands must be run on each HA node, and are not available for broken disks.
Repeat these steps for the partner node. This leaves the storage system in a permanently disabled state with all data erased. To use the system again, you must reconfigure it.

Power is available to the storage system and you must shred the data immediately

If you want to make the data on the disks inaccessible and still be able to reuse the disks, sanitize the disks:
If the storage system is configured as an HA pair, disable takeover.
Set the privilege level to advanced:

set -privilege advanced
If the drive is in FIPS-compliance mode, set the FIPS authentication key ID for the node back to the default MSID:

storage encryption disk modify -disk * -fips-key-id 0x0
Sanitize the disk:

storage encryption disk sanitize -disk * -force-all-states true

If you want to make the data on the disks inaccessible and you do not need to save the disks, destroy the disks:
If the storage system is configured as an HA pair, disable takeover.
Set the privilege level to advanced:

set -privilege advanced
Destroy the disks: storage encryption disk destroy -disk * -force-all-states true

The storage system panics, leaving the system in a permanently disabled state with all data erased. To use the system again, you must reconfigure it.

Power is available to the KMIP server but not to the storage system

Log in to the KMIP server.
Destroy all keys associated with the FIPS drives or SEDs that contain the data you want to prevent access to. This prevents access to disk encryption keys by the storage system.

Power is not available to the KMIP server or the storage system

Destroy the authentication item for the KMIP server (for example, the smart card). This prevents access to disk encryption keys by the storage system.

For complete command syntax, see the man pages.

ONTAP 9 Manuals ( CA08871-402 )

Emergency shred data on a FIPS drive or SED

On this page