Home | Product | Data Access Enforcer | What is Dynamic Data Masking (DDM)?
Dynamic Data Masking refers to a data security technique that dynamically masks or obfuscates sensitive information when a user requests access to data. The decision to mask data is determined at the time of the access request and can be based on attributes of the user, the data itself, and the environment or context in which the request is made.
Other terms that are often used to refer to data masking include anonymization, obfuscation, and tokenization, although these terms are sometimes defined slightly differently depending on context. Data masking and data obfuscation can help organizations protect sensitive information such as Personally Identifiable Information (PII), financial data, and other confidential information while allowing authorized users to access the data they need. See Gartner’s definition of Dynamic Data Masking, or DDM.
How Does Dynamic Data Masking (DDM) Work?
Dynamic Data Masking works by defining policies based on attributes of the user requesting access to the data, the data itself, and the context or environment of the request. Those policies are then evaluated at the time of the data request and a decision is made about what information the user is authorized to access and whether sensitive data should be masked or obfuscated.
Once the policy has been evaluated, the decision is enforced where the data is being accessed so that any data that should be masked is masked. This allows organizations to protect sensitive information without changing the underlying data.
What are the Techniques for Dynamic Data Masking?
There are several different ways that data can be masked or obfuscated
- Nulling Out: Replacing the original data with placeholders, such as zeros or asterisks. This process is not reversible.
- Encryption: Encrypting the data so that the original can only be recovered with a key, such as a password or other token. The key must be protected to make sure it is not compromised.
- Substitution: Substituting the original value(s) with a replacement value. This can be reversed if a lookup table is maintained, although the lookup table must also be properly secured.
- Data Obfuscation: Transforms sensitive information into a form that prevents unauthorized users from understanding or using the original value. Obfuscation can be applied dynamically based on security policies and the user’s access rights.
Why Should You Use Dynamic Data Masking?
Data Masking should be used whenever users need to access part of a data record to do their job, but are not authorized to view some of the data. In this case, any data that is restricted or sensitive can be masked. An example of this may be employee or customer data records, which can include Personally Identifiable Information, or PII. Access to PII may be covered by privacy regulations, or may just need to be restricted to limit the liability of the organization holding that PII. In any case, masking that PII within the employee or customer records allows users to perform the actions they need to take on those records without the risk of the PII being compromised.
Dynamic Data Masking can help organizations:
- Protect Personally Identifiable Information (PII) and other sensitive data
- Reduce the risk of unauthorized data exposure
- Support data privacy and regulatory requirements
- Enforce least-privilege access
- Protect sensitive information without modifying the underlying data
When Do You Need Data Masking or Obfuscation?
Data masking or obfuscation is particularly useful when users need access to a data record or application but should not be permitted to view all of the information contained within it. Applying masking at the data access layer allows organizations to protect sensitive information while minimizing disruption to applications and databases.
For example, an organization may allow a customer service representative to access a customer record while masking the customer’s Social Security number, financial information, or other sensitive data. An authorized user with the appropriate permissions can still access the complete record.
How Can Organizations Implement Dynamic Data Masking?
Dynamic Data Masking is best implemented at the data access level, which allows masking to be applied with minimal disruption to the applications or other resources that are accessing the data. When deployed at the data access level, Dynamic Data Masking solutions can implement the same interface as the underlying database, so that no applications or integrations using the database have to be modified. For the quickest deployment of a solution, products that have an out of the box integration with many database products, such as NextLabs’ Data Access Enforcer (DAE) can be deployed much faster than those that require custom code.Â
Solutions that support multiple data masking and obfuscation techniques can also reduce the amount of customization required when deploying Dynamic Data Masking across enterprise data environments.
Dynamic Data Masking with NextLabs
NextLabs Data Access Enforcer (DAE) provides data access security capabilities that enable organizations to protect sensitive information through fine-grained data masking, data obfuscation, and data segregation policies.
DAE can evaluate policies based on user, data, and environmental attributes to determine what information a user is authorized to access and whether sensitive data should be masked or obfuscated.
By enforcing policies at the data access layer, organizations can protect sensitive information without requiring extensive changes to applications or databases.
For more information on how NextLabs’ dynamic data masking functionality, see our Data Access Security product line, DAE.
F.A.Q.
What is Dynamic Data Masking?
Dynamic Data Masking (DDM) is a data security technique that dynamically masks or obfuscates sensitive information based on the user’s permissions, the data being accessed, and the context of the access request. Unlike static data masking, DDM protects data in real time without changing the underlying information.
What is the difference between data masking and data obfuscation?
Data masking and data obfuscation both protect sensitive information from unauthorized users by transforming or hiding the original data. The terms are sometimes used interchangeably, although specific techniques and definitions can vary depending on the implementation and use case.
What is the difference between static and dynamic data masking?
Static data masking permanently transforms sensitive data in a copy of a database, often for development, testing, or analytics. Dynamic Data Masking applies protection in real time when a user requests access, allowing the underlying data to remain unchanged.
Why is Dynamic Data Masking important?
Dynamic Data Masking helps organizations limit exposure to sensitive information while allowing users to access the data they need to perform their jobs. It can help protect PII, financial information, healthcare data, intellectual property, and other confidential information.
What types of data can be masked?
Organizations can use data masking to protect many types of sensitive information, including names, addresses, Social Security numbers, financial information, customer records, employee information, and other confidential business data.
Where is Dynamic Data Masking implemented?
Dynamic Data Masking can be implemented at the data access layer, allowing organizations to enforce masking policies before sensitive information reaches an application or user. This can reduce the need to modify individual applications or databases.
Does Dynamic Data Masking change the original data?
No. Dynamic Data Masking generally protects information by presenting an authorized or masked version of the data to the user while leaving the underlying data unchanged.
How does NextLabs support Dynamic Data Masking?
NextLabs Data Access Enforcer (DAE) enables organizations to apply fine-grained data access policies that can dynamically mask or obfuscate sensitive information based on user, data, and environmental attributes.
