Copyright 2014 Oracle and/or its affiliates. All rights reserved.

Transcription

1

2 Oracle Data Masking and Subsetting What s new & Best Practices Dinesh Rajasekharan Product Manager Oracle Data Masking and Subsetting Oct 02, 2014 Copyright 2014, Oracle and/or its affiliates. All rights reserved.

3 Program Agenda Oracle Data Masking and Subsetting Security challenges due to data proliferation What s new and product overview Best practices Customer Case study Q&A 3

4 Proliferation of Sensitive Data Increases Security Risks Development Partners Demo Testing Research Cloud Analytics Training 4

5 Compliance Drivers PCI DSS v3.0 November Production data (live PANs) should not be used for testing or development purposes. European Data Protection Directive The data subject shall have the right to obtain from the controller the rectification of personal data relating to them which are inaccurate. The Health Insurance Portability and Accountability Act of 1996 HIPAA The removal of specified identifiers of the individual and of the individual s relatives, household members, and employers is required and more 5

6 Finding a Solution Objectives Replace sensitive with fictitious data before sharing Extract relevant data Discard unneeded sensitive data Meet compliance requirements Oracle Data Masking and Subsetting Challenges Discover sensitive data Preserve application integrity Provide common masking formats and goal-based subsetting Provide integrated solution 6

9 Oracle Data Masking and Subsetting Pack Reduces Risk of Sharing by Obfuscating or Removing Sensitive Data Discover Sensitive Data NAME SALARY AGUILAR BENSON CHANDRA DONNER NAME SALARY AGUILAR CHANDRA Mask Data Using Format Library Subset Based on Goal/Condition Retain Application Integrity Mask/Subset in Export or on Staging 9

10 Application Data Modeling Sensitive Data Discovery Data Relationships Sensitive Columns Metadata Automated Discovery 10

11 Data Masking 11

12 Extensive Masking Format Library Provides common masking formats Supports custom masking formats Random numbers/strings/dates Substitute User defined PL/SQL function and more Templates for specific versions of E- Business Suite and Fusion Applications 12

13 Comprehensive Masking Transformations Mask Based on Condition Country Identifier CA US UK JX C Shuffle Records Country Identifier Health Health CA Records Records US UK AI D Emp ID First Name 324 Albert 986 Hussain Generate Deterministic Output HR FIN Emp ID First Name 324 Charlie 986 Murali Emp ID First Name 324 Charlie 986 Murali Generate Random Values Preserving Format Mask Operating System Files stored as Blobs Company Closing Price IBFG $36.92 XKJU Company Closing Price IBFG $89.57 XKJU BLOB Search : [0-9]{10} Replace : * BLOB ********** ********** and more 13

14 Comprehensive Masking Transformations (continued) Conditional masking Consistent masking Compound masking Format preserving Perturbation Shuffling Reversible masking Masks rows differently based on condition E.g. Mask national identifiers based on country Ensures the masked values is same across multiple databases E.g. Mask employee identifiers consistently across schemas and databases Reduces masking time by grouping related columns E.g. Mask related columns: address (street, state, country), or dates (birth, joining) Generates random values that maintain the original format E.g. Mask passport numbers or tax identifiers while keeping the format Generates random values within a user defined range E.g. Generate random dates within a specific range Shuffles the values within a column E.g. Shuffle clinical data or PII between electronic health records Encrypts and decrypts data based on a passphrase E.g. Outsourced data processing team can unmask data 14

15 Data Subsetting 15

16 Data Subsetting Use Cases Share relevant subset of data with internal and external teams Reduce storage cost for test/dev Extract subscriber data from SaaS Perform research and analysis on a subset of data Extract subset of data as part of e- discovery requests 16

17 Goal or Condition Based Subsetting Relative Database Size 100% 25% 10% 100M Rows Relative Table Size 20M Rows 2M Rows 1024 GB 256 GB 102 GB Condition Based Subset rows of department 10 17

18 Ease of Administration 18

19 Streamlined Management Pre-installed with Oracle Enterprise Manager(EM) Point Centrally managed using EM Unified interface for discovery, masking and subsetting Scheduling and reporting Command-line or scripting option 19

20 Masking and Subsetting Location Flexibility In-Database In-Export Production Staging Test/Dev Production Export Test/Dev Minimal impact on the production environment Sensitive data remains within the production perimeter 20

21 Data Masking and Subsetting Integrations Integration Point Database Lifecycle Management Pack Cloud Management Pack Real Application Testing Pack Oracle Data Integrator Oracle Database Gateways* Benefit Clone and mask Snap-clone and mask Mask in database workload captures Mask incrementally captured data Mask and subset non-oracle databases including SQL Server, DB2, Informix, Teradata (new), and more * Included in Oracle Data Masking and Subsetting license 21

22 Oracle Data Masking and Subsetting Summary Main Benefits Maximizes business value of data without compromising sensitive data Minimizes security risk by not proliferating sensitive data Narrows compliance boundary by masking sensitive data Reduces storage cost for test/dev by subsetting Key Features Automates sensitive data discovery, and maintains referential integrity Provides extensive masking format library and comprehensive transformations Supports goal and condition based subsetting Integrates with enterprise data management tools 22

24 Data Masking and Subsetting Methodology Discover sensitive data Discover data relationships Create Data Model Select Formats & Criteria Masking formats and templates Goals & conditions for subsetting Preview masking algorithm results Preview subset reduction results Preview & Validate Execute Transformation In-Database or In- Export Rerun with same data model 24

25 Best Practices Implementation Test backup and restore procedures prior to masking Allocate the right amount of storage space Use preview option to ensure desired results before script generation Performance Tune I/O of target Oracle Databases Apply generic Performance enhancement patch in Oracle Enterprise Manager Apply encrypt masking format patch in Oracle Enterprise Manager Apply Database optimizer enhancement patch in Oracle Database 11gR2 or below Update target Oracle Database stats before discovery, masking, subsetting 25

26 Best Practices for Performance Tuning (continued) Check Use parallel execution when possible in masking definition Increase the parallel degree if necessary Run SQL Tuning Advisor on long running SQL during script generation and execution Create SQL profile recommended by SQL Tuning Advisor Disable the created SQL profiles after masking and subsetting is done When using the In-Export method (a.k.a. At-Source) : Increase maximum number of threads in masking and subsetting definition Reduce the size of each generated dump file in masking and subsetting definition 26

28 Case Study: Data Masking for Security and Compliance About the Presenter Rama Kolli, Senior Director Information Architecture Company Background Financial services company Performs research and analysis of stocks and bonds Spanned across 25 countries with more than 10,000 employees Business Drivers Prevent exposure of Information assets in non-production environments Reduce the risk of accidental or intentional unauthorized access to context sensitive information in non-production environments Infrastructure 16 servers, 128 CPU Cores, 256 GB Memory per server, 22 Databases, Exadata Servers 28

29 Case Study: Benefits from Using Oracle Data Masking Automatic discovery of context sensitive information Deterministic masking to consistently mask values across multiple databases Preserves referential integrity of the database Ease of defining custom masking formats Ease of administration and maintenance Mask data in Oracle and SQL Server databases Acceptable masking time Masked 2TB database with 20 tables in 1 hour 29

30 What Other Customers Are Saying Name Sector Scenario Feedback on Oracle T-Mobile (Video) Wireless Telecommunications Mask sensitive data in nonproduction databases One of the main advantages of data masking is the ability to create entire sets of data and maintain referential integrity out of production without changing any applications. Alex Macknight, Principal Architect, Information Security, T-Mobile SquareTwo Financial (Video) Financial Services Replace slow performing legacy masking tool to achieve faster development and test cycles We achieved a 15 hour refresh time of 3TB database instead of 14 days refresh time. J.T.Gaieto, Manager, Information Security, SquareTwo Financial National Marrow Donor Program Healthcare Mask healthcare information in nonproduction environments We are able to consistently mask the data on all the non production databases. (Video) Kyle Nelson, Director, Business Engagement, Information Technology, National Marrow Donor Program Links to more customer stories are at the bottom of the Oracle Data Masking and Subsetting OTN page here. 30

31 Connect With Us /OracleDatabase /OracleSecurity blogs.oracle.com/ SecurityInsideOut blogs.oracle.com/ datamasking Oracle Database Insider /Oracle/database /OracleLearning oracle.com/database/security oracle.com/technetwork/database/security 31

32 Program Agenda Oracle Data Masking and Subsetting Security challenges due to data proliferation What s new and product overview Best Practices Customer Case study Q&A 32

33 Oracle Database Security at OpenWorld 2014 Time Session Title Location Monday 2:45 3:30 Oracle Database Security Innovations in the Year of Megabreaches (CON8204) Moscone South 303 Monday 5:15 6:00 Introducing Oracle Key Vault: Centralize Keys, Wallets, and Java Keystores (CON8189) Moscone South 305 Tuesday 10:45 11:30 Oracle Database 12c: Defense-in-Depth Security (CON8194) Moscone South 306 Tuesday 3:45 4:30 Oracle Audit Vault and Database Firewall: What s New and Best Practices (CON8180) Moscone South 306 Tues 5:00 5:45 Oracle Real Application Security Next Generation VPD Moscone South 308 Tuesday 5:15 6:15 Hands-On Lab #1: Oracle Key Vault (HOL9275) Hotel Nikko Golden Gate Wednesday 10:15 11:00 Oracle Advanced Security: Best Practices for Database Encryption and Redaction (CON8186) Moscone South 306 Wednesday 12:45 1:30 Oracle Database Security Strategy and Best Practices: Customer Case Study Panel (CON8192) Moscone South 310 Wednesday 3:30 4:15 Oracle Database Vault with Oracle Database 12c (CON8197) Moscone South 306 Thursday 9:30 10:15 What s New and Best Practices for Oracle Data Masking and Subsetting (CON8184) Moscone South 306 Thursday 11:30 12:30 Hands-On Lab #2: Oracle Key Vault (HOL9275) Hotel Nikko Golden Gate Plus: Visit the Oracle Database Security pods at the Demo Grounds for one-on-one discussions and demonstrations! Copyright 2014, Oracle and/or its affiliates. All rights reserved. 33

34 34

35