Data masking (deterministic)
Classify, localize and de-identify PII everywhere with data masking
Eliminate risks with data masking:
Consistently find and anonymize personally identifiable information (PII) in structured, semi-structured and unstructured sources.
Data masking: classifying, localizing, de-identifying and proving
Undetected data can damage your company's reputation and cost it millions in fines. Data masking offers a solution. IRI's award-winning in-place data anonymization tools have been proven in a variety of data breach detection, privacy law compliance and DevOps (test data) environments. Use an IRI Data Shield“ that is fit for purpose.Product (or several in the IRI Voracity data management platform) in order to to find and to mask, to preserve the referential integrity and this to prove.
Personally identifying information (PII)
Personally identifying information (PII)
Although there is no fixed list of PII in all data protection laws, there are common elements in these laws. In short, PII is information when used alone or with other data that identifies an individual. Government regulations such as SSAE16, SOC2, and the GDPR require that all PII be protected.
PII list
Social security number
Credit card number
Bank account number
First name
Surname
Address
Zip code
Email address
Date of birth
Passwords
Military ID
Driver's license number
License plate number
Phone number
Fax number
Protected personal health information (PHI)
Protected personal health information (PHI)
In the medical record, PHI identifies a health care recipient. U.S. HIPAA regulations require that 18 key identifiers be effectively de-identified or anonymized.
PHI list
Name
Address / Postcode / Geocode
Date
Phone number
Fax number
Email address
Social security number
Medical record number
Beneficiary figures
Account number
Certificate / license number
Vehicle identifiers
Device identifiers
URLs
IP address
Biometric identifiers
Facial images
All other unique identifiers
Primary Account Numbers (PANs)
Primary Account Numbers (PANs)
PAN is an identification number used in credit card transactions. The Payment Card Industry Data Security Standard (PCI DSS) requires card issuers, merchants and testers to encrypt, tokenize and otherwise protect this information.
PAN list
There is no list of PANs as they are unique to individual accounts. A PAN is a 14, 15 or 16-digit number that is generated as a unique identifier for a primary account.
Other sensitive information
Other sensitive information
Information such as codes and formulas that represent business or military secrets must be protected. You cannot afford to lose this critical data in the event of a data breach.
Other information list
Codes
Forms
Trade secrets
Military information
Classified information
etc.
Data masking: Data protection laws
According to the General Data Protection Regulation (GDPR), all personal data of a European Union citizen must be protected. Companies are required to protect any data that can directly or indirectly identify an individual („data subject“). These identifiers include, but are not limited to:
- Social security number
- Credit card number
- Bank Account Number
- First name
- Surname
- Address
- Zip code
- Email address
- Medical information
- Genomic information
- IP address
- Geolocation data
- Income and tax data
- Race, ethnicity and religious affiliation
- Sexual orientation
- Trade union membership
- Date of birth
- password
- Military ID
- Passport number
- Driver's license number
- License plate number
- Telephone and fax numbers
The law also gives citizens the Right to be forgotten, i.e., the ability to request that all information about them be removed from an organization's possession. IRI's data obfuscation products find the PII and PI you need in text, image or facial form and tell you where it is, and automatically delete, transmit and rectify it (immediately or later) so you can fulfill the right to erasure, portability and rectification under GDPR.
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student records and information. FERPA provides rights and protections to parents and eligible students. Once a student reaches the age of 18 or enrolls in a post-secondary institution, he/she becomes an „eligible student,“ meaning all rights previously controlled by parents are transferred to the student.
Under FERPA, a school generally may not disclose PII from an eligible student's records to a third party unless the student has provided written consent. Privacy includes PII and no less than the following additional information:
- Student name
- Student ID number
- Names of family members
- Place of birth
- Mother's maiden name
- Student training certificates
- Vaccination protocols
- Medical records
- Records of individuals with disabilities (IDEA)
- Attendance logs
The Federal Information Security Management Act of 2002 (FISMA) is a federal law that recognizes the importance of data protection and information security to economic and national security interests. Every federal agency must develop, document, and implement an agency-wide course of action to secure the system and assets that support the agency, including those managed by another agency, contractor, or other sources.
Information that must be protected under FISMAincludes PII and other sensitive information from these categories:
- Medical
- Financial
- Contractor Sensitive
- Security Management
- Other information specified by executive order, specific law, directive, policy, or regulation
The Federal Financial Institutions Examination Council (FFIEC) is an interagency government body that establishes uniform principles, standards and reporting forms to promote consistency in the supervision of financial institutions. In addition, the Council oversees real estate valuation.
Banks, credit unions and other financial institutions are subject to rules issued by the Council. In addition to PII and non-public personal information (NPI), these institutions must protect:
Income
Creditworthiness
Collection history
Family members PII and NPI
Data masking Compliance with data protection laws
Data privacy laws require that key identifiers be encrypted, pseudonymized, redacted or scrambled, and that quasi-identifiers be anonymized to prevent re-identification. IRI's data and database masking tools can find and obfuscate PII in various structured, semi-structured and unstructured sources to meet data erasure, portability and rectification requirements under GDPR and other regulations and assess re-ID risk under HIPAA, etc. Inquire about your mandates.
Apply multiple masking methods (data masking)
Use the IRI Workbench IDE for IRI FieldShield or IRI DarkShield, which is based on Eclipse™ to recognize, classify and mask data quickly and easily. Blur, encrypt, hash, pseudonymize, randomize, redact, scramble, tokenize, etc. Associate a deterministic data masking function with your searched data classes and apply it consistently to maintain realism and referential integrity across your organization.
Use role-based access controls (RBAC)
With data masking Define and enforce who can access specific data sources and destinations, masking rules and job scripts, data classifications and data layout definitions, decryption keys and log files, and even the masking programs themselves. Define different roles for different data sources and different access rights based on these roles.
Data masking: Use multiple audit logs
All IRI data obfuscation tools generate machine-readable audit logs that you can back up, query and view or export to SIEM tools to reliably document everything that has been changed, verify compliance with data protection laws without concerns about tampering, trigger alerts and take action. This is how auditing sensitive data should work.
Find out which data masking tool you should use
Search, classify, mask and risk grade PII in structured data sources, including legacy files (flat COBOL, CSV, LDIF files), ODBC-connected databases, cloud applications such as Salesforce, etc. Use AES-256 FPE, blurring, hashing, redaction, pseudonymization, tokenization, etc.
Search for PII in one or more Excel® worksheets simultaneously, create reports, mask them and review them with point-and-click options in Excel itself. Search and mask intracellularly, protect formulas and even entire sheets.
Recognize, deliver and delete sensitive information in structured, semi-structured and unstructured sources, including: text, JSON, XML, HL7/X12 and flat files, MS and PDF documents (including embedded images), Parquet, RDB C/BLOB and free-floating text columns, NoSQL DBs (such as MongoDB, Cassandra and Elasticsearch), DICOM and other image formats, and soon audio and faces.
You get all three IRI data masking tools and test data management in a comprehensive data lifecycle management platform that consolidates big data discovery, integration, migration, governance and analytics. In addition to FieldShield, CellShield EE and DarkShield, Voracity includes IRI RowGen, to generate synthetic but realistic test data. Create (and mask) DB subsets or generate intelligent test data from scratch for DB/ETL prototypes, analytical and AI models, product demos and application or hardware stress tests.
Resources
Compliance toolkit for GDPR
Podcast on data-centric security: Outlook Series
Data protection suite PDF
Data masking: White Paper
Data protection: Blogs
Data protection: LinkedIN-Group
Why data masking?
Find sensitive information in structured, semi-structured and unstructured sources and anonymize sensitive data consistently.
Static or dynamic data masking?
Static data masking is the primary method of protecting certain data elements at rest. Dynamic data masking works in conjunction with applications in real time to prevent unauthorized users from seeing values while the source data remains unchanged.