Protecting Data in a Spooky world Data Masking Technologies DAMA RMC Oct. 29, 2014

Transcription

1 Business Glossary Business Intelligence Data Architecture Master Data Management Protecting Data in a Spooky world Data Masking Technologies DAMA RMC Oct. 29, 2014 Aspen Information Solutions, Inc Lowell W. Fryman

2 Agenda What is Data Masking How do we Mask data What is the Value What are the different types of Data Masks Discuss some of the leading Technologies 2

3 What is Data Masking Data Masking is used to help protect sensitive data at rest and in transit from insiders and outsiders abuse Helps protect from abuse and negligence sensitive data such as Credit card numbers Social Security numbers Sensitive Personal data (PSI/PSI) Health data (diagnoses/ treatments) Other financial data Adapting data masking technology and processes helps raise the level of security and privacy assurance Data Masking is also called data obfuscation, sanitization, scrambling, deidentification, or deauthenticiation 3

4 How do we use the technology Data Masking should be used as an integrated portfolio of data security technologies Data Masking helps meet compliance requirements imposed as audit, security and privacy standards Data Masking prevents abuse by hiding data. Data Masking techniques include Substitution: Replacing characters with similar looking characters Masking: Replacing characters with masking characters ( x ) Replacing last names with fictional last names (Konabi) Shuffling: Reshuffling data in the database columns (random shuffle of characters) Number and Date variance: Apply variance algorithm Null out: Null or delete data in certain columns Encryption 4

5 Current Environment Data Breaches Could Data Masking have helped Target Norstroms Home Depot Florida Law (when will it be adapted by others) Financial Crimes/AML Laws 5

6 Types of Data Masking Static data masking (SDM) Applies masking technology to the physical data being stored. Used mostly to deter misuse in non-production databases. Most popular form for protecting data in development and test environments. Most mature technology Dynamic data masking (DDM) Used on production data in real time Typically a DDM Monitor intercepts each request to the database and analyzes it. The Monitor modifies the database response by masking the sensitive data based upon the masking rules and user entitlements. No physical database changes are done Data Redaction Used to mask unstructured content such as documents, PDF and spreadsheets 6

7 Gartner Magic Quadrant The Leader Quadrant IBM Informatica Oracle Other Interesting Firms Camouflage Software (Challenger) Dataguise (Visionary) Voltage Security (Visionary) 7

8 Example - Shuffling Let s take my Name and shuffle it Shuffling each character with the third character First character goes to 4 th 4 th goes to 1 st 2 nd goes to 5 th 5 th goes to 2nd Lowell Fryman (one name column) ELLLOWYMA FR N With First Name and Last Name columns ELLLOW (FIRST) MANFRY (LAST) 8

9 Gartner MQ for Masking Technologies Leaders IBM Informatica Oracle Challengers Camouflage Software Visionaries Dataguise Voltage Security 9

10 IBM Acquired Princeton Softech in 2007 Combined with acquisition of Guardium in 2009 to accelerate development of DDM InfoSphere Guardium Data Activity Monitor or InfoSphere Optim Data Privacy is DDM Largest installed base of SDM Great support within the Rational and InfoSphere suites Generally on consumers short lists New pricing model based upon volume of masked data Technical skills are inconsistent, products are complex Masking for Big Data platforms available since Q

11 Informatica Acquired Applimation in 2009 for SDM Acquired ActiveBase in 2011 for DDM SDM product is Informatica Persistent Data Masking DDM product is Informatica Dynamic Data Masking One of the largest SDM installed base Also offers data redaction In Q announced DDM support for Hadoop, Cloudera, Hortonworks, and MapR Newer lower priced cloud-based solutions Technical support skills reported as lacking 11

12 Oracle SDM product is Oracle Data Masking Pack High performance in masking data in an Oracle DB Strong adoption of Oracle Enterprise Manager promotes the Data Masking Pack DDM product is Oracle Data Redaction (part of the Advanced Security offereing) Oracle Database Gateway must be part of the solution Data Redaction not offered as a tool but offer a set of APIs Masking for Big Data only in Oracle Big Data Appliance 12

13 Camouflage Software An early stage vendor releasing SDM in 2004 See Product is Data Masking Lifecycle Management Suite Product and customization services Strong product reputation and technical support Willingness to work with developers and testers SDM is User-friendly, easy to learn, flexible to install Just started to offer DDM, data redaction limited to Excel Small network of partners Does not have other data management technologies 13

14 Dataguise SDM vendor since 2007 SDM product is DgSecure Easy to learn, user-friendly, with flexible masking rule engine Can be used with Big Data platforms Strong partner, Compuware, uses DgSecure in its SDM service offerings Strong customer service One of the pioneers in Hadoop data masking Recent large VC investments Masks a limited number of databases 14

15 Voltage Security Voltage Security focuses on encryption and data tokenization Voltage SecureData Enterprise uses Format-Perserving Encryption (FPE) and Secure Stateless Tokenization (SST) The product provides data masking functionality for production and non-production SDM masking capabilities provided via APIs to ETL tools like Informatica PowerCenter Voltage FPE is innovative and its AES-FFX cipher mode is being standardized by NIST Voltage FPE can be reversed or made irrevsible Available for Hadoop, certified for Cloudera and Hortonworks 15

16 Contact for Additional Information Lowell W. Fryman