DATA MASKING SOLUTIONS Microsoft and not so much

PROCESS Mask Personally Identifiable Information: IDENTIFY MASK PROOF

FIRST : DEFINE THE MODEL PII DEFINITION OR WHAT DEFINES PERSON IDENTITY? The term “PII,” as defined in OMB Memorandum M-07-1616 refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual . US General Services Administration Personally Identifiable Information is a sensitive and critical organizational resource. Credit Card Numbers Names DOBs

WHY MASK? COMPLIANCE: HIPAA, GLBA, PCI, PIPEDA, STATE LAWS the Privacy Rule, the Transactions and Code Sets Rule, the Security Rule, the Unique Identifiers Rule, the Enforcement Rule. DYNAMIC DATA MASKING (Section 164.308) Information access management's implementation specifications: Implement policies and procedures for granting access to electronic, protected health information, for example, through access to a workstation, transaction, program, process, or other mechanism.  STATIC DATA MASKING (Section 164.502) …When using or disclosing protected health information or when requesting protected health information from another covered entity, a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

DIFFERENT SCENARIOS – DIFFERENT PROTECTION METHODS Insider’s trade Selling PII on the “black market” Rare Selling PII, sabotage CxO Production user DBA Developer

INTERNAL THREAT SOLUTIONS EXTERNAL: ENCRYPTION INTERNAL: DATA MASKING Method Media Protects against Role SDM Disk –at rest Developer, outsourcers DDM Application –in real time Business Roles, third parties

OR… MICROSOFT FINALLY SUCCUMBS TO THE MARKET NEEDS Oracle Informatica IBM

SQL SERVER AZURE AND 2016 DYNAMIC DATA MASKING

DATA MASKING DEFINITION The process of masking specific data elements while preserving data look and feel and usability in applications. ALGORITHMIC CHALLENGE DATA INTEGRITY CHALLENGE STATISTICAL CHALLENGE

QUICK INTRO TO ALGORITHMS VARIETY OF ALGORITHMS SUBSTITUTION: random -DDM, SDM in fields without Primary/Foreign Key Constraints preserving RI –DDM, SDM CHARACTER PERMUTATION CHARACTER SUBSTITUTION random –DDM, SDM in fields without Primary/Foreign Key Constriants preserving RI – DDM, SDM Format Preserving Encryption (patented) – is a variation of preserving RI substitution SHUFFLE – SDM mainly due to performance Time and Number Variance –DDM mainly, in some cases - SDM Nulling –DDM, not suitable for SDM fields with Primary/Foreign keys constraints

UNIQUE IDENTIFYING ELEMENTS UNIQUE DATA Social security number (123-45-6789) Passport number (С00001234) Credit card (4234-5678-9123-4567) Driver’s license (123-456-789) Etc. SDM: MASKED DATA 987-65-4321 A00009876 4276-5432-1987-6543 654-987-321 DDM: MICROSOFT WAY SSN: xxx-xx-6789 CC: xxxx-xxxx-xxxx-4567

HANDS ON IDENTIFY PROBLEMS FOR STATIC

PROBLEM: STATISTICS AS AN ENEMY 10002 : 100,000 people F – 50,000 04/3/1996 – 5,000 DDM: MICROSOFT WAY Does not know anything about statistics: as it is one records at a time Need different way Common Name Noah Uncommon Broderich

DIFFERENT WAY: STATIC DATA MASKING Development Module should be Test Environment, Train Environment, QA Environment (3 squares) Creating Custom Test Data Solution Takes up to 4-5 man-months

DATA LIFECYCLE AND MASKING PRODUCTION SYSTEMS REPORTING SYSTEMS ETL MASK Yes, promote to production Transactional Data Master Data Yes, promote to Staging Yes, promote to the QA QA: Move new master data Run test cases Staging/UAT:Move New Master data, test for deployment Do UAT SANDBOX: Create master data and test cases. test NO errors? NO errors? NO errors? DATABASE Create a DDL script in the source control Create DML Scripts - optional Production Now, users are “testers” ERRORS CLEAR ALL THE TEST CASES LEAVE MASTER DATA Get Delta Mask Sensitive Data Move Staging Apply a Transform To Accommodate DDL change Move To Sandbox Move To QA ETL Package Identity Access Management Pass Through

GAP FIX MOVE DATA WITH HUSH-HUSH COMPONENTS Development Modules should be Test Environment, Train Environment, QA Environment (3 squares) Move Schema – Check Mark Move Code – Check Mark Move Data – Stop Sign

Virginia Mushkatblat HushHush info@mask-me.net 1.855.YOU.HUSH

SCHEDULE POST SQL SAT Hi there, Virginia Mushkatblat is inviting you to a scheduled Zoom meeting. Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/453310671 Or iPhone one-tap: 16465687788,453310671# or 14157629988,453310671# Or Telephone: Dial: +1 646 568 7788 (US Toll) or +1 415 762 9988 (US Toll) Meeting ID: 453 310 671 International numbers available: https://zoom.us/zoomconference?m=JcDmVzF8gcLRSQVBylvzw7B6bcFy38PW