Static Data Masking versus Dynamic Data Masking

In my last blog post, Basics of Data Masking, I explained the fundamental concepts of data masking and discussed different methods to mask data. While that article briefly touched on static data masking and dynamic data masking, this is an important topic to fully understand when you decide how to mask your sensitive data, maintain data security, and comply with data protection regulations like GDPR, PCI, and HIPAA. In this article, I’ll explain more about both types of masking, their pros and cons, and use cases for each.

Static Data Masking

Static data masking is when you directly alter data values with anonymized values, either with encryption or other anonymization techniques such as data set generation. Static data masking applies the same masking method for all users and applications that access the data. This is typically done on a copy of your production database (a replica) to ensure no loss of original data, and that replica can be used safely elsewhere in non-production environments.

The biggest advantage of static data masking is that the masked data can never expose the sensitive value. The biggest disadvantage is that you must maintain a masked version and an unmasked version of your data. With ever increasing amounts of data within organizations, this can be incredibly costly, depending on your use case. These are the two best use cases for static data masking:

• Cloud migrations are a great use case for static data masking. By masking the data before migration, it prevents sensitive data from being exposed during the migration process, avoiding costly data breaches. Additionally, migrating masked data ensures you comply with data protection regulations and protect your data as dictated by your cloud vendor’s shared responsibility model.
• Creation and maintenance of lower software environments is another use case where static data masking can be powerful. Companies maintain various environments for testing and development of software. Production data can be statically masked to create copies for development and test environments, providing access to realistic data while also protecting sensitive data.

Dynamic Data Masking

Dynamic data masking is when sensitive data is masked in real-time, at the point when it is accessed by users and applications. It is incredibly powerful because it allows role-based access controls to be implemented and does not destroy the original data value. The biggest advantage of dynamic data masking is flexibility. Masking policies can be customized to meet your requirements, including compliance requirements. Dynamic data masking provides granular control over who sees what data and when they see it. The biggest disadvantage is that it does take time to create and govern a data masking policy.

Dynamic data masking greatly expands the use cases your data can serve. It’s a data management best practice to encrypt sensitive data in a database. Dynamic data masking allows you to real-time decrypt and mask the data when it’s being used. Here are some use cases where dynamic data masking is a great fit for protecting sensitive data:

• Real time access control use cases: dynamic data masking ensures only authorized users can access sensitive data. One example is customer service where a representative can only be able to see the last four digits of a credit card number. Another example is patient care where the care coordinator may only be able to see the last four digits of a social security number. In both cases, a fraud investigator may have cleartext access to all information in a customer or patient’s file.
• Compliance use cases: Many of the regulatory compliance requirements – PCI, GDPR, CCA, HIPAA – dictate that organizations control access to sensitive data based on data context and user permissions. Dynamic data masking is a powerful way to meet compliance regulations by using role-based access controls.
• Data Sharing use cases: Dynamic data masking can protect sensitive data while sharing it with external parties. This allows companies to collaborate and utilize shared data while also ensuring that sensitive data is kept protected.

Data Masking with Baffle

Baffle’s Data Protection Services provides both static and dynamic data masking options. While we believe encrypted, dynamic data masking to be one of the best and most secure options out there, we also understand that may not be desired for every data use in every situation. Our flexible platform provides you robust options to mask your sensitive data the way you want to mask it, and to enable both field-level and record-level data masking. We do all of this with no application code changes, helping you avoid lengthy projects to protect your data.

Learn More

To see a demo of data masking and discuss your data protection concerns, please schedule a meeting with Baffle.