Protection of Sensitive Information Virginia Commonwealth University June 10, 2011 Created by Marcus Mickle

Introduction PSD is an optional data security feature in our ERP System.

Agenda Give an overview of how PSD can restrict access to sensitive personal information.

PSD can restrict users from accessing information such as Example PSD can restrict users from accessing information such as birthdays, Social Security numbers, and addresses outside of their functional areas. FGAC Business Profiles Validation (GTVFBPR) - used to define business profiles. FGAC Business Profile Assignments (GOAFBPR) - Assign users to the Business profile that will need to access data mask. Data Display Mask Columns Form (GORDMCL) – use this form to define the items that require protection of sensitive data on person search pages. Data Display Mask Rules Form (GORDMSK) – use this form to define the display masks applicable to the associated fields on SCT Banner forms.

Making an item invisible on a form (removes an item from the internet Security Option 1 Making an item invisible on a form (removes an item from the internet form). FGAC Business Profiles Validation (GTVFBPR) - used to define business profiles. FGAC Business Profile Assignments (GOAFBPR) - Assign users to the Business profile that will need to access data mask. Data Display Mask Columns Form (GORDMCL) – use this form to define the items that require protection of sensitive data on person search pages. Data Display Mask Rules Form (GORDMSK) – use this form to define the display masks applicable to the associated fields on SCT Banner forms.

Security Option 2 Concealing data (replacing an item’s value with all asterisks ‘******’).

Security Option 3 Masking data (partially masking a birth date or Social Security number to hide some of the data displayed).

Cannot assign a mask to conceal values in a pull-down list. Limitation of PSD Cannot assign a mask to conceal values in a pull-down list.

Display masks can be applied to all Benefit of PSD Display masks can be applied to all users, a group of users, or a specific user. Note: If an item (a field) is set to Visible, and a format mask is applied, then the masked field will be set to that.

Source code does not have to be customized to protect sensitive data. Benefit of PSD Source code does not have to be customized to protect sensitive data. Caution: An Oracle error may occur in some cases when the first field in a block is not visible (when Visible is unchecked for the item).