Dynamic Data Masking

Describes the Dynamic Data Masking feature that allows you to mask sensitive information when retrieving data.

Dynamic Data Masking (DDM) is the ability to apply a variety of data masks in real time, depending on who is accessing the data. DDM aims to mask data in transit, but leaves the original data in the database unaltered. You can configure DDM on designated database fields to hide sensitive data in the result set of queries. Starting in release 7.0.0 of HPE Ezmeral Data Fabric, all fields of JSON tables support DDM.

HPE Ezmeral Data Fabric has column family, column, and field-level ACEs, as well as Policy-Based Security, which allows you to create security policies that control access to information. ACEs and security policies provide an all-or-nothing approach - either the data for the column or field is returned or not returned.

As a typical example, consider the credit card industry. The application that prints receipts for credit card purchases does not need the full credit card numbers but only needs the last four digits of the credit card number to identify the credit card being used. However, in the same organization, the full credit card number should be available for payment processing. With ACEs and policies, you either get the credit card number or not. You cannot use ACEs or policies to return only the last four digits of the credit card number. Dynamic Data Masking offers the solution.

The advantage of DDM is that it is easy to use and backward compatible with existing applications. DDM applies the masking rules to query results, with no modifications required to existing queries. The disadvantage of DDM is that it is not a fully secure solution for the sensitive fields; it does not prevent users from connecting to the database and running exhaustive queries that expose pieces of sensitive data. Therefore, view DDM as a complementary solution to other database security features, such as auditing, encryption, and row/column-level security.