What is Data Masking?

Data masking is the process of creating a structurally similar but false version of a dataset to obscure sensitive information it contains. Data masking is used in business security, such as protecting proprietary information, or for regulatory compliance, such as protecting personally identifiable information (PII) or protected health information (PHI). You can use various techniques to mask data so it is realistic and structurally similar. After you have properly masked data, it can't be reverse-engineered or traced back to reveal the original data values without access to the original dataset. Data masking allows developers and analysts to work with realistic data without exposing sensitive information.

Data masking techniques support an organization's efforts to meet data privacy regulations like the General Data Protection Regulation (GDPR). You can protect many data types such as personally identifiable information (PII), financial data, protected health information (PHI), and intellectual property.

Next, we explore some data masking use cases.

Secure development

Software development and testing environments require real-world datasets for testing purposes. However, using real data raises security concerns. Data masking allows developers and testers to work with realistic test data that resembles the original, but without exposing sensitive information. It reduces security risks in development and testing cycles.

Analytics and research

Data masking allows data scientists and analysts to work with large datasets without compromising individual privacy. Researchers derive valuable insights and trends from the data and ensure privacy protection. For example, scientists can use anonymized datasets to study the effectiveness of new medicines, analyze treatment outcomes, or investigate potential side effects.

External collaboration

Organizations often need to share data with external partners, vendors, or consultants. By masking certain fields or attributes, organizations can collaborate with external parties and still protect sensitive data.

Employee training

You can use data masking for employee training sessions or software demonstrations. By masking sensitive data, organizations can provide realistic examples without exposing genuine customer or business data. Employees can learn and practice skills without the need to access data that they don’t have authorization for.

You can apply several different types of data masking.

Static data masking

Static data masking is the process of applying a fixed set of masking rules to sensitive data before it's stored or shared. The static data masking process is used most often for data that remains unchanged, or static, over time. For example, let's say you want to conduct a series of tests using a safe copy of sensitive data. You make a backup copy, strip extraneous data until you only have what is necessary for testing, and apply static data masking to it. Now you have a clean, consistent testing set safe for manipulation.

Dynamic data masking

Dynamic data masking applies masking techniques in real time. You dynamically alter existing sensitive data as users access or query it. It's primarily used to implement role-based data security, for example, in customer support and medical records handling.

Deterministic data masking

Deterministic data masking methods assign the same masked output value to every instance of the same input value in your dataset. This type of data masking is necessary to maintain referential integrity. Deterministic masking techniques often involve data substitution or tokenization, in which a consistent mapping is maintained between the original data column and the masked values.

On-the-fly data masking

On-the-fly data masking operates on sensitive data in a system's working memory. There is no requirement to store the altered data in the database. On-the-fly masking is useful in continuous deployment pipelines or in complex integration scenarios where data continuously flows between production and non-production environments. At any given stage in the deployment pipeline, the application masks the data that it has been handed and passes it on.

Statistical obfuscation

Statistical data obfuscation involves masking sensitive data values in a way that preserves the original data's overall distribution, patterns, and correlations for accurate statistical analysis.

There are several different algorithm types you can use for data masking.

Randomization

With randomization, you replace sensitive data with randomly generated values that do not correlate to the original data. For example, you can replace names, addresses, or other personally identifiable information with fictional or randomly selected values.

Substitution

Substitution masking replaces sensitive data with predefined, synthetic data. For example, you can replace actual names with names from your predefined list. You can also use data masking algorithms to generate similar but fake data.

Shuffling

With shuffling data masking, you reorder the values within a dataset to preserve statistical properties and relationships after you make individual records unidentifiable. For example, you can randomly shuffle column data so row values change. Practically, you could preserve the association between a customer and their transactions while switching names and contact details.

Encryption

Encryption transforms sensitive data into an unreadable format using cryptographic algorithms. Unlike masking, encryption is reversible by authorized users holding the correct decryption keys. Although encryption offers a higher level of security compared to simpler algorithmic methods of data masking, it introduces computational overhead. Query performance often degrades because the system must decrypt the data in real time before you can analyze it.

Hashing

Hashing is a transformation technique that converts data into a fixed-length string of characters. It's commonly used for masking passwords or other sensitive information where the original value isn't needed, and your goal is just to verify data.

Tokenization

With tokenization, you replace production data with a randomly generated token or reference value. You store the original data in a separate secure location and use the token as a substitute during processing or analysis. Tokenization helps maintain data integrity while minimizing the risk of exposing sensitive information.

Nulling

Nulling (or blanking) is data masking that replaces sensitive data with null values or blank spaces. This effectively removes the masked data from the dataset. This approach is suitable when you want to retain the data format or structure, but specific, highly sensitive information must be completely concealed.

Working with sensitive data in any form can be challenging and carries a degree of risk. Here are specific challenges to be aware of when performing data masking.

Attribute preservation

It's important for research and analytics that data masking preserves the original data attributes for certain data types. Your data masking tools should preserve the original data types or the frequency distribution of any associated sensitive data categories.

For example, you might accidentally impact your analytics if a tool alters the demographic representation of customer data or card category statistics when it obfuscates credit card details. Attribute preservation can be challenging in certain data masking processes, such as randomization or tokenization.

Data uniqueness

In cases where the original data requires uniqueness, such as employee ID numbers, the masked data technique must provide unique values to replace the original data. Absence of uniqueness in key fields may create potential conflicts or inconsistencies.

Integration with existing workflows

It can be challenging to integrate data masking into existing workflows, especially during initial implementation stages. It can inconvenience employees as they adjust to the new processes and technologies. To ensure a smooth integration and minimal disruption, your organization should focus on carefully planning your data masking strategy, stakeholder collaboration, and the timely resolution of user concerns.

Many Amazon Web Services (AWS) offerings have built-in data masking capabilities. Here are some examples:

• Amazon Transcribe automatically converts speech to text and can mask sensitive data as requested.
• Amazon Redshift uses SQL to analyze structured and semi-structured data across data warehouses, operational databases, and data lakes. It supports role-based access control, row-level data security, column-level data security, and dynamic data masking techniques.
• Amazon Simple Notification Service (Amazon SNS) is a notification service. You can use it to define data protection policies that can discover, mask, and protect sensitive data in transmission.

Data masking is appropriate for many use cases, including complex sensitive data requirements. For example, for a data masking solution that helps healthcare organizations identify and mask health data in images or text, you could use the following services:

• Amazon Comprehend Medical detects health data in a body of text
• Amazon Rekognition identifies text in an image
• Amazon API Gateway and AWS Lambda provide an API interface for this functionality
• AWS Identity and Access Management (IAM) authorizes API requests

You may also consider choosing from one of several premade data masking solutions in the AWS marketplace.

Get started with data masking on AWS by creating a free account today.