How can you mask sensitive data?

1 Static data masking

Static data masking is the process of modifying the data in a source database before copying it to a target database or environment. For example, you can use static data masking to create a masked copy of your production database for testing or development purposes. Static data masking ensures that the target database does not contain any sensitive data that could be compromised or misused. Static data masking can be done using tools such as SQL Server Data Masking, Oracle Data Masking and Subsetting, or DataVeil.

2 Dynamic data masking

Dynamic data masking is the process of masking the data on the fly as it is queried or viewed by different users or applications. For example, you can use dynamic data masking to hide or mask certain columns or fields in your database based on the user's role or permission. Dynamic data masking does not change the data in the source database, but only alters the output that is displayed to the user. Dynamic data masking can be done using features such as SQL Server Dynamic Data Masking, Oracle Virtual Private Database, or DataSunrise.

3 Format-preserving encryption

Format-preserving encryption is a method of encrypting the data in a way that preserves the format and structure of the original data. For example, you can use format-preserving encryption to encrypt a credit card number with 16 digits and keep it as a 16-digit number, rather than a longer or shorter alphanumeric string. Format-preserving encryption can help you maintain the functionality and integrity of your database applications while securing the data. Format-preserving encryption can be done using algorithms such as FFX, BPS, or FF1.

4 Data anonymization

Data anonymization is a method of removing or modifying any identifying or personal information from the data, such as names, addresses, phone numbers, or email addresses. For example, you can use data anonymization to replace the names of your customers with random names, or to hash or truncate their email addresses. Data anonymization can help you protect the privacy of your data subjects and comply with data protection laws such as GDPR or HIPAA. Data anonymization can be done using techniques such as generalization, perturbation, or pseudonymization.

5 Data tokenization

Data tokenization is a method of replacing the sensitive data with non-sensitive tokens that have no meaning or value outside of a specific context. For example, you can use data tokenization to replace the social security numbers of your employees with random numbers that are mapped to the original numbers in a secure token vault. Data tokenization can help you reduce the exposure and storage of sensitive data and simplify the compliance with data security standards such as PCI DSS. Data tokenization can be done using services such as Protegrity, TokenEx, or Vault.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?