This is the first of a series of posts dealing with data-masking. There are many software providers in this specialized industry. Some of the providers are also database providers attempting to capture this additional add-on market. There is a traditional tendency for these big companies creating add- ons to produce only a basic version lacking key features. These key features will often be provided by a company whose sole business is data-masking. These companies always strive to differentiate themselves by providing more at less cost.
The primary motivators for data-masking are government laws and regulations. A few examples are:
- Sarbanes-Oxley,
- Payment Card Industry (PCI) Data Security Standard (DSS),
- Health Insurance Portability and Accountability Act (HIPAA),
- EU Data Protection Directive
- General Data Protection Regulation
The core reasons for this protection are typically:
- Protecting an individual's privacy
- Protecting an organization's privacy. Corporations and most organizations are deemed "persons" in most of the western world.
- Preventing information being available that may assist inside trading of stock (or equivalent)
- Preventing unfairness in the marketplace: for example, exposing a firm's customers, what they ordered, and the price actually charged for goods.
For several years I was working for Patchlink, and Lumension Security. I was their representative to the Security Content Automation Protocol and other initiatives sponsored by the National Institute of Standards and Technology (NIST). NIST activities have yet to expand to data masking, but such action is expected in the next few years. NIST has produced only one related paper, "Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)" SP-800-122 (Apr 2010), which is worth reading. If you are the data masking owner in your organization, this is not an optional read;; the contents would have considerable legal weight as "normal or expected practices" because the source is NIST.
A Higher Level of Protecting Information
Often management in corporate America takes a minimalist approach "if it follows the general advise of my data-masking provider, it is good enough" which translate to, "if things goes bad, I want to be absolved of responsibility and have some other party guilty of not doing their job". With the duration of time in most IT jobs being short before moving on to the next position in a different company, this approach is a safe bet for the manager (but may not be a good bet for the company). I am of the temperament of being very pro-active and wish to prevent data exposure ever happening;; be it on my shift, or after my shift.
Looking at best practices for Data Masking is one of the goals of this blog.
No comments:
Post a Comment