In the evolving landscape of data privacy and security, protecting sensitive information is more critical than ever. As regulations become stricter and data breaches more common, organizations must find ways to secure sensitive data without sacrificing functionality. Two common techniques used for data protection are Dynamic Data Masking (DDM) and Static Data Masking (SDM), with Format-Preserving Encryption (FPE) emerging as a viable alternative for non-production data.

In this blog, we’ll explore the similarities and differences between DDM, SDM, and FPE, and determine which solution is best for protecting sensitive data.

What is Dynamic Data Masking?

Dynamic Data Masking protects data by altering it at the time of access—masking sensitive values without changing the underlying data. Because the masking doesn’t occur until data is accessed, the way masking is applied can change based on who is accessing data, what data is being accessed, and how data is being accessed. Only authorized users can see the original data; everyone else sees a masked version.

>>> You Might Also Like: Snowflake Masking Policy: DIY vs ALTR

How Dynamic Data Masking Works

Imagine a database with customer information, including sensitive fields like social security numbers, addresses, or payment details. With DDM, when a user queries the database, the sensitive data is automatically masked based on their access level:

• A customer support representative might only see the last four digits of a social security number.
• A financial officer can view all transaction details unobscured.
• A general analyst may not be able to see any sensitive data at all.

DDM is applied in real-time, meaning that only authorized users can view full, unmasked data. The unmasked data is always securely stored in the database.

Benefits of Dynamic Data Masking

• Real-Time Data Protection: Sensitive data is masked as it is accessed, ensuring protection is up-to-date.
• Granular Control: DDM allows you to apply different access levels to different users and different use cases, enhancing security.
• No Need for Data Duplication: Since the data is masked at the presentation layer, there’s no need to copy the data to separate environments or to create different versions of the data for different users.

Challenges with Dynamic Data Masking

Performance

Although typically minimal, dynamic data masking does require extra logic at query runtime. This could add milliseconds or more to queries, depending on the amount of data accessed and the complexity of the masking logic. It’s crucial to make sure that masking logic is optimized and thoroughly tested for performance before being productionalized.

Complexity

Creating dynamic data masking policies to support many different masks and use cases on a single piece of data requires specialized knowledge from a technical resource. Larger organizations with complex business rules often require robust development, testing, and deployment practices when implementing dynamic data masking on their own.

>>> You Might Also Like: Why Engineers Should Ditch Manual Masking Policies in Snowflake

Compromised Privileged Accounts

With dynamic data masking, the raw data is still stored in the database. A admin or other highly privileged user with unmasked access could have their credentials compromised leading to data loss. It’s critical to ensure that the proper authentication, access controls, and auditing are in place to prevent account hijacking.

What is Static Data Masking?

Static Data Masking (SDM) involves creating a version of the original data with sensitive information permanently redacted or anonymized. This transformation process occurs once, and the masked data is stored in the database instead of the original data. SDM helps mitigate the risk of exposing sensitive data in these environments but doesn’t provide real-time data protection.

How Static Data Masking Works

When creating a masked copy of the data, SDM takes sensitive information (like customer names, addresses, and credit card numbers) and replaces it with partially or fully redacted data. This masked copy can be used in cases where some data is necessary for testing or development.

For example:

• Real addresses might be replaced with random strings that still adhere to the same formatting, but it doesn’t correspond to actual locations.
• Social Security Numbers might be replaced with “**REDACTED**”
• Phone Numbers might be replaced so that the middle digits are all “555”.

The key difference here is that once data is masked, it cannot be reverted back to its original form – and different versions of the mask require making different copies of the data.

Benefits of Static Data Masking

Minimized Attack Surface

By protecting data at rest, organizations can be assured that there is no way to access the sensitive, raw data values – even for privileged users.

Query Performance

By transforming the data on load, instead of at access time, there is no additional compute required when users run queries.

Ease of Use

When building policies internally and explaining them to stakeholders, it is often easier to explain simple static masks than to show and decipher the SQL and conditionals of complex dynamic data masking policies.

Challenges with Static Data Masking

Data Duplication

You have to create and maintain a copy of the original data, which can introduce data synchronization issues and storage challenges.

No Granular Access Control

SDM applies the same mask to all users, which means it can’t provide nuanced access restrictions like DDM can unless you make and control access to even more copies of the data.

Limited Real-Time Control

SDM doesn’t allow you to protect sensitive data dynamically at the time of access; once the data is masked, it stays that way, regardless of who accesses it.

Format-Preserving Encryption (FPE) as an Alternative to Static Data Masking

Format-Preserving Encryption (FPE) offers an excellent alternative to Static Data Masking, allowing data to be encrypted at rest while maintaining its original format. This means that sensitive data such as email addresses, phone numbers, and Social Security numbers can be protected at rest, but the format of the data (e.g., length, data type) remains the same.

>>> You Might Also Like: MasterLabs on Format Preserving Encryption

How Format-Preserving Encryption Works

With FPE, sensitive data is encrypted in such a way that its structure and alphabet is preserved. For example, an email address like “[email protected]” can be encrypted to cyphertext like “[email protected]”. It maintains the original format, which is crucial for downstream systems that perform validation. FPE can be especially useful in environments where real-world-like data format is necessary for testing, but exposing sensitive information isn’t acceptable nor required for functionality.

Key Benefits of Format-Preserving Encryption

Reversible Alteration

Unlike Static Data Masking, which alters data irreversibly, FPE ensures that the data is protected but can still be decrypted when necessary.

Deterministic Protection at Rest

Like SDM, FPE creates encrypted data that looks realistic, but protected values are still unique and deterministically generated from their source value. This allows customers to protect sensitive data to meet regulations like HIPAA and GDPR while still allowing common query clauses, such as “WHERE” and “GROUP BY” to function properly even on protected data.

Realistic Data Formats

By maintaining length, alphabet, and special characters, FPE ensures that downstream applications can still validate data format while not accessing the sensitive information itself. This is especially useful for developing and testing software systems that perform such validations.

Challenges with Format-Preserving Encryption

Key Management

When using FPE, you need to be careful with what keys are used to protect which data. Look for solutions that offer robust key management capabilities with easy options for key rotation and similar operations.

Controlling Decryption

Although FPE is reversible, it can be challenging to control access to the decryption function. Choose vendors that offer easy ways access control on the decryption function, or even integrate decryption into other protection types – like Dynamic Data Masking!

Algorithm Selection

FPE is only as secure as the algorithm used to protect data. Favor tools that leverage public, open-source algorithms that have been battle-tested over those that rely on proprietary methods that haven’t been proven to be secure.

When to Use Format-Preserving Encryption?

Format-Preserving Encryption is particularly useful when sensitive data must be used in environments where:

Data Format Consistency

FPE enables you to maintain your data’s original format, like in financial transactions or processing systems, without exposing actual data.

Non-Production Testing

FPE allows teams to work with encrypted data that still behaves like real data, ensuring more realistic testing and development without compromising data security.

Compliance

Organizations with regulatory requirements demanding protection at rest can use FPE altering the data format, and enabling data to still be decrypted when necessary.

Dynamic Data Masking vs. Static Data Masking vs. Format-Preserving Encryption: A Comparison

Conclusion: It… Depends.

Static Data Masking, Dynamic Data Masking, and Format-Preserving Encryption all offer different ways to protect sensitive data, with different benefits and tradeoffs in flexibility, performance, and ease of use.

Static data masking is best for simple use cases – such as creating dummy data for a demo or sandbox. However, SDM doesn’t make as much sense in production or development use cases, as you lose out on the value and usefulness of the original data. It can also lead to duplication and increased storage costs as you generate additional masked data.

Dynamic Data Masking is best for protecting sensitive production data where a user’s level of access might depend on who they are and how they’re accessing data. Privileged users can still access the raw values when needed, such as a support agent requiring a customers phone number, while fully or partially obscuring data when necessary. However, DDM can be difficult to build and deploy at scale – and is less useful in development and testing environments where there are large numbers of privileged users who can access raw data.

Format-Preserving Encryption is best for protecting sensitive data at rest, both in non-production and production environments. Because data is deterministic and maintains its format, users such as analysts can still leverage data for analytics, and internal developers can still test software that expects data to be in a particular format. However, FPE can be very difficult to deploy without help, especially for use cases requiring sophisticated key management. It can also impact performance where users regularly require access to decrypted data.

By choosing the right approach for your needs you can ensure your sensitive data is safeguarded while maintaining usability and compliance. ALTR offers both data masking and encryption options, with expertise on which security tools to use for your use case as well as easy to use tools for automating complex masking and encryption policies.