Ensuring Data Privacy with Dynamic Data Masking in Snowflake

In today’s data-driven world, ensuring the privacy and security of sensitive information is paramount. Snowflake’s Dynamic Data Masking offers a robust solution for protecting data at a granular level, making it a crucial feature for data engineers.

This article delves into how DDM works, its benefits, and important topics from the SnowPro Core certification perspective.

Let's first understand the type of security available in Snowflake. First one is Column level & another is Row-level security.

• Column-level Security in Snowflake allows the application of a masking policy to a column within a table or view. Currently, Column-level Security includes two features namly Dynamic Data Masking & External Tokenization.
• Snowflake supports Row-level security via row access policies, which define which rows are visible in query results. These policies can be simple, allowing a specific role to view rows, or more complex, involving mapping tables to determine access.

Lets' deep dive in Column-level Security in Snowflake to understand the importance of Data masking, Type, Benefits, Practical use case.

Importance of Data Masking in Snowflake

In the context of Snowflake, data masking is crucial for several reasons:

1. Data Security: Protects sensitive data from unauthorized users.
2. Compliance: Helps meet regulatory requirements such as GDPR, HIPAA, and other data privacy laws.
3. Data Privacy: Ensures that users can work with realistic data without exposing actual sensitive information.

Types of Masking

1. Dynamic Data Masking:- Data is stored unmasked but appears masked when queried. Policies are applied at the schema level. One policy per data type.
2. External Tokenization: Uses external functions for masking. Allows ingestion of tokenized data into Snowflake. Process: send tokenized data to Snowflake, apply masking policies, and detokenize based on roles.

What is Dynamic Data Masking?

Dynamic Data Masking (DDM) in Snowflake allows you to mask your data dynamically based on the user querying the data.

This means the data remains unmasked in storage but appears masked when accessed by unauthorized users. This is particularly useful for maintaining privacy without altering the underlying data.

Key Features

• Data Stored Without Masking: Data remains unmasked in storage.
• Schema Level Object: Policies are applied at the schema level.
• Policy Creation: Separate policies for each data type that requires masking.

Implementing Dynamic Data Masking

Here's a step-by-step guide to implementing data masking in Snowflake:

Step 1: Create Masking Policies

Masking policies define how data should be masked. For example, to mask a credit card number, you might define a policy that shows only the last four digits.

CREATE MASKING POLICY mask_credit_card AS (val STRING) 
RETURNS STRING ->
CASE 
    WHEN CURRENT_ROLE() IN ('ANALYST') THEN 'XXXX-XXXX-XXXX-' || SUBSTRING(val, 13, 4) 
    ELSE val 
END;        

You can see masking policy named "mask_credit_card" is created with String datatype & enabled on "ANALYST" role.

Step 2: Apply Masking Policies to Columns

ALTER TABLE customer_data 
MODIFY COLUMN credit_card 
SET MASKING POLICY mask_credit_card;        

Once you have defined a masking policy, apply it to the relevant columns in your tables.

Step 3: Grant the custom role to a user

Grant the ANALYST custom role to a user.

GRANT ROLE analyst TO USER jsmith;        

Step 4: Role-Based Access Control

Ensure that roles and permissions are properly configured to control who can see the masked and unmasked data.

GRANT SELECT ON customer_data TO ROLE analyst;        

Step 5: Query data in Snowflake

Execute two different queries in Snowflake, one query with the ANALYST role and another query with a different role, to verify that users without the ANALYST role see a full mask.

-- using the ANALYST role
USE ROLE analyst;
SELECT credit_card FROM customer_data ; -- should see plain text value

-- using the PUBLIC role
USE ROLE PUBLIC;
SELECT credit_card FROM customer_data ; -- should see partial mask data         

Real-World Example

Consider a financial services company using Snowflake to store customer data, including credit card numbers.

By applying a masking policy, the company can ensure that analysts querying the data for reporting purposes see only masked credit card numbers, while authorized personnel can access the full data when necessary.

Important Topics from Certification Point of View

1. Masking: It is schema level objects. Available in Enterprise Edition and above. Essential for protecting sensitive columns.
2. Types of Masking: Dynamic Data Masking- Masks data on query execution. External Tokenization- Uses external functions to mask and detokenize data.

Conclusion

Dynamic Data Masking in Snowflake is a vital feature for maintaining data privacy. By using DDM, you can ensure sensitive information is protected and compliant with various regulations.

Understanding and implementing these features is essential for any data engineer aiming to excel in their role and certification exams.

Feel free to follow me Sudeep Kumar ? for more insights and tips on mastering Snowflake and other data engineering tools!

To Your Transformation??

Sudeep Kumar

Azure Certified Data Engineering Professional | Data Engineering Career Mentor & Coach

Snowflake Documentation References:-

https://docs.snowflake.com/en/user-guide/security-column-ddm-intro

https://docs.snowflake.com/en/user-guide/security-column-ddm-use