Reducing data production exposure is becoming an increasingly important precautionary measure for every business and due to the GDPR regulation Data Masking has taken off. Losing sensitive data jeopardizes the trust between companies and customers which will soon be a legal liability for companies, as is already the case in countries like The United States. Data Masking is increasingly important and needs to be integrated into a more general data governance strategy.
Our CEO, Alberto Scavino explains what is Data Masking and why it helps with GDPR compliance.
The power of Data Masking
Data Masking is a technique that hides original sensitive data with dummy data. Not only is data blurred and anonymised but also pseudonymised rendering it unrelated to a person’s identity while maintaining data validity and usability. It’s crucial that data remains valid for test cycles and consistent throughout subsequent usage features.
The data blurring process provides an answer to GDPR’s confidentiality and compliance requirements as well as the PSD2. This directive aims to create a single and integrated market for payment services, by standardizing banks’ rules with challenging requirements but also expanding business opportunities through the development and dissemination of APIs accessible to third parties and the opening of their core banking systems.
Data Masking may involve replacing data with similar data, random data or rewriting data among itself. Regardless of the process, constraints and relationships between data must be adhered to. Data must always be useful and meaningful, useful for business, respecting the context and purpose of use.
Data must also be consistent over time, on the same line – Fiscal Code always accurate according to date and place of birth. – Similarly, if I change Rome with Milan you have to do it with all instances and between different sets adhering to hierarchies and linkage. Regardless of the amount of data, you must always be able to document the process and its rules in detail.
How do you implement Data Masking?
Best practices for a Data Masking project include identifying sensitive data, defining masking policies to be applied and monitoring and verifying accurate functioning. Policies must be re-usable: The one generated for Fiscal Code masking for application “A” must be also available to use with application “B” so there’s always a procedure portfolio immediately available.
Within the Data Masking process two contexts of use can be identified:
Persistent Data Masking: It consists in creating a masked data base for the application, testing, training, etc; thus protecting production data. The masked data target can be a database or a file.
Dynamic Data Masking: It consists in masking the same data to those who need to have access only occasionally, such as the provider of a remotely-connected solution to detect a malfunction.
By combining persistent and dynamic data masking with traditional data security controls, companies can provide comprehensive coverage of the security needs of their data.
Companies can therefore protect (in real time) testing, outsourcing, supporting, analytics and client reporting data in addition to eliminating data security risks due to internal and external attacks.
With the new regulations coming into force Data Masking has become an essential part of the Data Management process and a masking tool, with all its combined features, must be integrated into the process and technical architecture of the Enterprise Data Management system.