Static versus Dynamic Data Masking

Data Protection: Masking for Security

Let’s begin with a brief introduction to why many of us seek masked data. The primary reason is data security. In numerous databases, you’ll find personal and privacy-sensitive information. To shield this data from exposure and potential breaches, it requires robust security measures. One of the most efficient and effective approaches is data masking, particularly before using it for purposes like testing and development.

Now, let’s explore the various methods of data masking to determine which one suits your organization best.

What is Static Data Masking (SDM)?

In the realm of data security and privacy compliance, one essential technique is Static Data Masking (SDM). But what exactly is it?

SDM involves the transformation of data at rest to protect sensitive information within production databases. Its primary purpose is to provide realistic and representative data, which is often essential for software tests like functional testing and regression testing. Generating synthetic data from scratch is sometimes risky as it may not accurately replicate the production environment.

The significance of SDM becomes evident when addressing the requirements of privacy regulations such as GDPR, PCI, and HIPAA. By replacing sensitive data with altered, masked data, SDM ensures data security while maintaining data integrity.

The process of static data masking can be executed through ETL-like solutions or specialized tools designed to work directly within the database.

A typical static masking architecture involves the presence of a single full-size copy of each production database, often referred to as the “Golden copy” or “Test Data Master.” This is the only layer in the lower environment subject to data privacy legislation, making it the ideal candidate for data masking application.

The “Test Data Master” typically serves as the primary source for all other lower environment deployments. These full-size copies are not only crucial for development and testing purposes but also serve the needs of performance testers and BI developers who require a production-level volume experience, often in read-only or select mode.

Static data masking achieves its objectives by realistically altering sensitive data through the application of masking rules and synthetic data generation. This transformation is permanent, offering significant advantages in terms of privacy and data protection.

What is Dynamic Data Masking (DDM)?

Dynamic Data Masking, often referred to as on-the-fly data masking, is a technique used to protect sensitive data during transit, without altering the original data at rest. Its primary purpose is to conceal specific data from certain users while maintaining the integrity of the data in the database.

In DDM, data is not physically masked within the database itself; instead, masking occurs in the query result. This means that the unmasked data remains visible in the actual database. It’s important to note that dynamic data masking does not apply to stored procedures directly. Masking stored procedures would require rewriting the query results rather than the queries themselves.

Dynamic data masking is frequently employed in production systems. It involves the use of dynamic data masking tools to create a masking layer on top of the existing data. This layer ensures that specific roles or individuals only see certain masked data, while the data itself remains unaltered underneath.

Data Masking with DATPROF

The DATPROF Suite offers a static data masking solution that directly masks, transforms, and alters data within the database without the need for data extraction to an ETL platform. By executing queries directly on the database and applying the masking template, data does not traverse through additional tooling, ensuring a secure and efficient process.