Data masking is a technique used to create a version of data that looks structurally similar to the original but hides (masks) sensitive information. The version with the masked information can then be used for various purposes, such as user training or software testing. The main objective of masking data is to create a functional substitute that does not reveal the real data.

The majority of organizations have stringent security controls that protect production data when it rests in storage and when it is in business use. However, sometimes data is used for less secure operations like testing or training, or by third parties outside the organization. This can put the data at risk, and might result in compliance violations.

Data masking offers an alternative that can allow access to information, while protecting sensitive data. Data masking processes use the same data format to emulate the original data, while changing the values of sensitive information.

There is a wide range of ways that can be used to alter data, including character shuffling, word or character substitution, and encryption. Each method has its unique advantages. However, when masking data the values must always be changed in some manner that makes reverse engineering impossible.

Here are several examples of data masking:

• Replacing personally-identifying details and names with other symbols and characters
• Moving details around or randomizing sensitive data like names or account numbers
• Scrambling the data, substituting parts of it for other parts from the same dataset
• Deleting or “ nulling out ” sensitive values within data records
• Encrypting the data to make it infeasible for unauthorized users to access it without a decryption key

In this article we will discuss:

• • Which Data Requires Data Masking?
  • Types of Data Masking
  • 8 Data Masking Techniques
  • What Are the Challenges of Data Masking?
  • Data Masking Best Practices

Here are the most common data types that require data masking:

• Personally identifiable information (PII) —data that can be used to identify certain individuals. This includes information like full name, passport number, driver’s license number, and social security number.
• Protected health information (PHI) —data collected by healthcare service providers for the purpose of identifying appropriate care. This includes insurance information, demographic information, test and laboratory results, medical histories, and health conditions.
• Payment card information— the Payment Card Industry Data Security Standard (PCI DSS) requires merchants that handle credit and debit cards transactions to appropriately secure cardholder data.
• Intellectual property (IP) —data related to creations of the mind, including inventions, business plans, designs, and specifications, have high value for an organization and must be protected from unauthorized access and theft.

Here are three common types of data masking:

If you want to reflect sensitive data in terms of averages or aggregates, but not on an individual basis, you can replace all the values in the table with the average value. For example, if the table lists employee salaries, you can mask the actual individual salaries by replacing them all with the average salary, so the overall column matches the real overall value of the combined salaries.

7. Shuffling

If you need to retain uniqueness when masking values, you can protect the data by scrambling it, so that the real values remain, but are assigned to different elements. Given the salary table example, the actual salaries will all be listed, but it won’t be revealed which salary belongs to each employee. This method is best suited to larger datasets.

8. Date Switching

If the data in question involves dates that you want to keep confidential, you can apply policies to each data field to obfuscate the real date. For example, you can set back the dates of all active contracts by 100 days. The drawback of this method is that, because the same policy applies to all values in a field, the compromise of one value results in the compromise of all values.

Here are some of the key challenges involved in data masking:

• Format preservation — the data masking solution has to understand the data (i.e what it represents). When the masking system replaces the original data with inauthentic data, it should preserve the original format. This is especially important for data threads that require a specific order or format, such as dates.
• Referential integrity — the tables in a relational database are connected via primary keys. When the masking solution obfuscates or replaces the values of a table’s primary key, these values must be modified consistently across the database.
• Gender preservation — the masking system should have gender awareness when replacing a person’s name in the database, and be able to detect if the name is male or female. The gender distribution in a table will be altered if the masking system changes names randomly.
• Semantic integrity — databases typically enforce rules that limit the range of values permitted (e.g. the range of salaries). Any masked data must fall within the specified range in order to preserve the semantics (meaning) of the data.
• Data uniqueness — when masking unique data, the masking system should apply unique values for every data element. If the table in question stores employee SSNs, for example, each employee should receive a unique SSN after masking. The frequency distribution of the masked data should be retained, especially if the distribution is meaningful (i.e. geographic distribution). Each column on the table should have similar masked data values to the original, on average.

Best practices for data masking include:

• Data discovery— before you can protect your data, you need to have a grasp of the data you are holding, and distinguish the various types of information with varying degrees of sensitivity. Security and business experts typically collaborate to produce an exhaustive record of all the data components across an enterprise.
• Survey of circumstances —the security director responsible for determining the availability of sensitive data should oversee the circumstances in which the data is stored and used, and decide on the appropriate concealing strategy for each type of data.
• Veiling actualization —for large enterprises, it is not realistic to apply a single data masking technique across all datasets. Each type of data has to be considered in terms of the appropriate arrangement, engineering and usage needs.
• Veiling testing —this involves testing the results of data veiling techniques. The QA and testing teams must guarantee that the data masking techniques used offer the desired outcomes. In the event that a masking technique falls short of expectations, the DBA must restore the database to the original, unmasked state and apply a new masking procedure with new calculations.

Data Masking with Satori

Satori enables dynamic masking over any data platform being accessed, based on your choice of security policies, and can be set based on identities, data locations, as well as by data types.

Read More:

• Blog: 9 Common Struggles Data Teams Face With Data Masking Projects
• Dynamic Masking on All Your Data with Satori
• Book a Demo Meeting

The information provided in this article and elsewhere on this website is meant purely for educational discussion and contains only general information about legal, commercial and other matters. It is not legal advice and should not be treated as such. Information on this website may not constitute the most up-to-date legal or other information. The information in this article is provided “as is” without any representations or warranties, express or implied. We make no representations or warranties in relation to the information in this article and all liability with respect to actions taken or not taken based on the contents of this article are hereby expressly disclaimed. You must not rely on the information in this article as an alternative to legal advice from your attorney or other professional legal services provider. If you have any specific questions about any legal matter you should consult your attorney or other professional legal services provider. This article may contain links to other third-party websites. Such links are only for the convenience of the reader, user or browser; we do not recommend or endorse the contents of any third-party sites.

• Data Masking
• Snowflake Data Masking
• Redshift Data Masking
• Data Encryption
• Data Tokenization
• How K Anonymity Preserves Data Privacy
• Data Generalization
• Data De-Identification
• Pseudonymisation
• Data Anonymization
• Dynamic Data Masking
• The Fundamentals of Data Obfuscation
• Unmasking Data Masking Tools – Types And 5 Best Practices
• The Fundamentals of Data Redaction
• Putting a Premium on Data Masking Solutions: The Best Data Masking Tools
• Data Masking Standards: The Ins and Outs of Database Data Masking