Secure Test Data Management with ORACLE Data Masking

Transcription

1 Secure Test Data Management with ORACLE Data Masking Michael Schellin Consultant, OCM DOAG Regio München, Dec 2009 Baden Basel Bern Brugg Lausanne Zürich Düsseldorf Frankfurt/M. Freiburg i. Br. Hamburg München Stuttgart Wien Agenda Introduction Requirements and Expectations Oracle s Approach Data are always part of the game. Challenges and Solutions Summary 2 1

2 Agenda Introduction Requirements and Expectations Oracle s Approach Data are always part of the game. Challenges and Solutions Summary 3 Definition Data masking is the process of obscuring (masking) specific data elements within data stores. It ensures that sensitive data is replaced with realistic but not real data. The goal is that sensitive customer information is not available outside of the authorized environment. Data masking is typically done while provisioning non-production environments so that copies created to support test and development processes are not exposing sensitive information and thus avoiding risks of leaking. Masking algorithms are designed to be repeatable so referential integrity is maintained. 4 2

3 Why mask? Production Database are usually well secured Think of ASO, DB Vault, reliable passwords, proxy authentication Non-Production is not. Reasons: Licence cost savings Personnel savings developer = dba Ease of administration username = password Regulations: SOX, Basel II, EU Data Protection Directive, PCI-DSS 5 Agenda Introduction Requirements and Expectations Oracle s Approach Data are always part of the game. Challenges and Solutions Summary 6 3

4 Requirements and Expectations Fundamental Requirements Data Format Data Distribution Amount of Data Repeatable Process Extensibility 7 Requirements Fundamental Requirements Irreversibility no possibility of getting back to original data from masked data Complete masking apparently not relevant data needs to be masked if it could lead to sensitive data Referential integrity relations between data sets needs to be maintained 8 4

5 Expectations Data Format Your application might expects a defined format Check constraints Data Distribution Among others, the CBO bases it s decisions on that attribute Amount of Data Must be able to mask large data sets Again, CBO 9 Expectations Repeatable Process We do not want to reinvent the wheel with every iteration Extensibility Applications change, schema design changes You need to change the masking definition according to these changes You want to do that incrementally 10 5

6 Agenda Introduction Requirements and Expectations Oracle s Approach Data are always part of the game. Challenges and Solutions Summary 11 Oracle s Way Oracle Data Masking Pack 12 6

7 ORACLE Data Masking Pack Available as an Enterprise Manager Pack Grid Control Database Control Database Version must be >= x No Installation. Out-of-the-box usable Part of ORACLE s Maximum Security Architecture 13 ORACLE Data Masking Pack - Consists of 2 Parts Format Library Repository for named data format definitions create once, use many ORACLE delivers predefined formats Credit card numbers (VISA, AMEX, ) ISBN s UPC (EAN) Masking Definitions Interface for creating and editing definitions Generate masking scripts Schedule jobs Start the clone and mask workflow 14 7

8 ORACLE Data Masking Pack Suggested Workflow 15 ORACLE Data Masking Pack Masking Process Data Formats 1/2 Type Varchar2 Number Date Example Fixed Number X X 100 Fixed String X Mueller Substring X ueller Random Number X X 4711 Random Digit X 0047 Random String X lurelm Random Date X Array List X X X 1,2,3 Shuffle X X X Table Column X X X Subsitution X X X 16 8

9 ORACLE Data Masking Pack Masking Process Data Formats 2/2 User defined function Post-processing fuction Truncate NULL Value Delete Preserve original data Condition based masking Available since Allows different masking options for logical data partitions Based on different WHERE-conditions 17 ORACLE Data Masking Pack Masking Process The Maskingprocess is always a Reorganization DDL, (almost) no DML Pure SQL is used as much as possible Control of options relevant for performance Logging / Nologging Parallel Degree Statistic Generation LOB s, XML types, LONG, RAW, object types, cluster can not be masked 18 9

10 ORACLE Data Masking Pack - Live Demo 19 Agenda Introduction Requirements and Expectations Oracle s Approach Data are always part of the game. Challenges and Solutions Summary 20 10

11 Challenges and Solutions Data Distribution Orphan Keys Recursive Select s 21 Challenges and Solutions Data Distribution Histograms are needed if data is not uniformly distributed Non-numeric data types needs special attention since only the leading 6 bytes are used Avoid leading constants Use substring for your masking definition 22 11

12 Challenges and Solutions Orphan Keys Childrecords without parent Result of: Incomplete data models Online Reorganizations Tuning by removing FK s Know your data Procedures to ensure data cleanliness Foreign keys are your friend 23 Challenges and Solutions Orphan Keys How does ORACLE Data Masking treat them? It depends on the version Grid Control Automatic data cleansing Grid Control Keeps orphaned values sets the child key to NULL Database Control Let you choose Search for Sicheres Testdatenmanagement Best Practices on trivadis.com 24 12

13 Challenges and Solutions Recursive Select s How can Data Masking know about your data structure? Check constraints Uniqueness Relationships If a table contains orphan keys? How is sample data generated? some of them can cause Data Masking GUI to hang up 25 Agenda Introduction Requirements Oracle s Way Data are always part of the game. Challenges and Solutions Summary 27 13

14 Summary Fundamental Requirements Data Format Data Distribution Amount of Data Repeatable Process Extensibility 28 Core Messages Powerful SQL Generator Out-of-the-box masking possible Almost unlimited extensible Data are always part of the game. More advanced control features would help API for scripting needed Support for subsetting desireable 29 14

15 mehr zu 11g? TechnoCircle München, Oracle Database 11g New Security Features Thank you!? Baden Basel Bern Brugg Lausanne Zurich Düsseldorf Frankfurt/M. Freiburg i. Br. Hamburg Munich Stuttgart Vienna 15