How can you determine which data elements to mask in your data governance strategy?

For data masking within a comprehensive data governance strategy, I would like to emphasize the importance of considering two key standards: the Critical Data Elements Standard and the Data Classification Standard. Critical Data Elements Standard: This standard identifies and defines the critical data elements within your organization. Data Classification Standard: Data comes in various forms, and not all data carries the same level of sensitivity. The Data Classification Standard provides a framework for categorizing data based on its sensitivity. These two standards play a pivotal role in ensuring the security and privacy of sensitive data within any organization. I hope this information is helpful for your understanding.

As part of the risk assessment, the potential impact of exposure and/or sharing of sensitive data should be analyzed. Data management/Data Governance leaders should get with business leaders on defining or identifying such sensitive data and classify them. There may be a strategy established for that.

Most of the systems have sensitive data elements. The sensitive data elements, if in wrong hands, can be misused. Business and Data Owners should identify such data elements and mask them. Every data element should be analyzed for sensitivity and highly sensitive or most critical data elements should be handled in efficient way.

Data sensitivity can also be managed at multiple levels of sensitivity. For example, it is common in financial services and other industries to categorize data as Sensitive Private Information (SPI) and Personally Identifiable Information (PII). For example, a client's name and address is considered PII while their Social Security Number / Social Insurance Number or Credit Card Number are considered SPI. A combination of PII together can result in SPI.

Organizations need to assess the sensitivity of their data, considering factors such as the nature of their business, applicable regulations, and potential risks. It is important to note that sensitive data extends beyond Personal Identifiable Information (PII), Sensitive Personal Information (SPI), and Personal Health Information (PHI). Equal emphasis should be placed on data that do not directly identify a person, but can be used to identify an individual when combined with other data. Furthermore, critical non-personal data, such as financial information, should also be given due consideration as it holds significant importance for the business.

Here, data masking appears to be used more generically and I also interpret it as data encryption or even hashing. The key question is about data security at rest and motion, as well as access control of sensitive data. Sensitive data, and at times all data is encrypted at rest via transparent encryption, whereas data is encrypted in motion via symmetric and/or asymmetric encryption plus TLS. Also Format Preserving Encryption is gaining popularity when data as a means of securing data while still showing its format. Plus, a variety of AI tools like the one by @PrivateAI is emerging that masks data on the fly.

We should consider how records i.e digital records are stored/saved that contain masked data. For information that is highly classified access to records needs to be restricted.

I agree that defining the data masking requirements is a critical step in the data masking process. The data masking requirements specify the conditions and criteria for applying data masking to the data elements. This ensures that the data is masked in a consistent and compliant manner.

To define the data masking requirements, you need to identify the relevant sources, stakeholders, and scenarios that affect the data masking decisions.

Data masking techniques can be classified into two categories: static and dynamic. Static data masking is performed once on a copy of the data, usually at the source or before moving it to another location. Dynamic data masking is performed on the fly on the original data, usually at the point of access or query.

Based on my limited exposure here are few types of Data Masking that could help us all: - Substitution: Replacing sensitive data with fictitious data. For example, replacing real names with random names. - Shuffling: Randomly reordering data elements within a dataset to break the link between original data and masked data. - Character Masking: Replacing specific characters in sensitive data, such as credit card numbers or SSNs, with placeholders (e.g., "**** **** **** 1234"). - Format Preserving Encryption: Encrypting the data while preserving the format, allowing for reversible masking when needed. - Tokenization: Replacing sensitive data with tokens that can be mapped back to the original data through a tokenization system.