The importance of data de-identification in the risk assessment framework

Dataguise highlighted recent research and analysis showing that de-identification through data masking is an important aspect of a company’s overall risk assessment framework.

Masked data is used in application development, testing, quality assurance, support and business analysis by a range of private and governmental entities.

Data masking is the process of obscuring (masking) specific data elements within data stores. It ensures that sensitive data is replaced with realistic but not real data. The goal is that sensitive customer information is not available outside of the authorized environment.

Data masking is typically done while provisioning non-production environments so that copies created to support test and development processes are not exposing sensitive information and thus avoiding risks of leaking. Masking algorithms are designed to be repeatable so referential integrity is maintained.

Common business applications require constant patch and upgrade cycles and require that 6-8 copies of the application and data be made for testing. While organizations typically have strict controls on production systems, data security in non-production instances is often left up to trusting the employee, with potentially disastrous results.

Creating test and development copies in an automated process reduces the exposure of sensitive data. Database layout often changes, it is useful to maintain a list of sensitive columns in a without rewriting application code. Data masking is an effective strategy in reducing the risk of data exposure from inside and outside of an organization and should be considered a best practice for curing non-production databases.

With the volume of information rising among organizations in every category, data masking provides the best avenue for conducting information dependent operations without putting the data at risk of exposure.

To secure sensitive data, masking technologies that provide optimal sensitive data privacy risk management, automate the identification, categorization and periodic review of sensitive data holdings are advantageous.

Of the available options, those that provide actionable intelligence and enable information security, compliance officers and infrastructure managers to better understand shared responsibilities for protecting data are preferred. These provide an integrated solution for better risk management, improved operational efficiencies and reduced regulatory compliance costs.