The software-based approach of data masking

Data masking

While implementing data masking, an organization can choose to either build and run its own data masking scripts as a niche and localized masking solution or explore a formal software-based approach of data masking.

Organizations may observe initial merits in building their own niche or localized data masking solution, as this approach initially requires lower investments and provides control over the solution design, making deployment appear easy. Organizations can also demonstrate their privacy awareness on immediate terms. However, over time, the benefits of this approach could lose its sheen, due to challenges related to the script-based approach of data masking. So, organizations may need to explore a software-based approach for data masking. Some challenges related to the script-based approach of data masking are shared below.

Data masking challenges

• Data, application, and location heterogeneity: Organizations deal with various types of legacy and modern data, in diverse formats and storage. Varied applications include home-grown, third-party, packaged, mainframe, on-premises, cloud, cloud-hybrid, multi-cloud, analytics, and so on. Since the IT ecosystem is getting complex over time, niche scripts may not be able to meet the demand of supporting the ever-evolving data formats, applications, and enterprise-wide coverage.

• Scope: The scope of the data privacy program is dynamic and can change if the applicable data protection regulation is amended to include new data privacy requirements or sensitive data categories. The IT landscape of organizations is evolving constantly as businesses grow and undergo mergers and acquisitions. Bespoke, localized scripts and solutions may not be amenable to accommodating changes with agility, due to the evolving scope. Such modifications may have an associated maintenance cost, which may not be apparent initially.

• Scalability: To deliver business value with agility, organizations need swift turnarounds for their application enhancements. This translates to the need for delivering privacy-safe data with shorter turnaround times. Given the rising data volumes and shrinking time-to-value, the niche script-based approach for data masking may find it a struggle to scale up.

• Self-service: Data masking, just like similar data management activities is also witnessing the trend where business and IT users can configure and operate the functionality on their own, with minimal intervention of technical experts. Handling scripts may require distinct IT knowledge, as scripts and code changes will need to be re-configured occasionally for meeting specific masking requirements. Scripts will also struggle to match the usability aspect and good experience provided by well-designed and engaging software products.

• Functional richness: Superficially, data masking appears simple, but it is a complex activity catering to the intricacies and nuances of real-world data. In addition to data-diversity, data fields may have inter-relationships, computationally derived values, proportional distribution, or consistency requirements. This may apply to a single data store or across data stores, and lines of businesses in some cases. Niche masking scripts may not be sophisticated enough to tackle these requirements.

• Governance: While the data masking scripts may be successful at masking data, however, it might not be insufficient. Organizations must demonstrate effectiveness and coverage of data masking used in data privacy programs. Data masking requires governance and tracking. Appropriate data masking metrics will need to be defined, measured, and monitored to gauge the level of completion and effectiveness. Data masking operations will need to be restricted only to certain organizational roles, and controls cannot be easily implemented using a script-based approach or a niche, localized masking solution.

• De-risking: A select set of employees will have the intelligence surrounding the architecture of in-house solutions and its deployments. Due to the inevitable employee-churn, new employees will need to be trained, but it may not compensate the loss of knowledge, at least in the short term. This will inevitably lead to a short-term risk in engineering, deployment, and support of in-house solutions. De-risking is the driver for organizations preferring commercial software, as it shifts operational risk from in-house teams to third parties.

Conclusion

Data masking implemented through niche masking scripts, as a bespoke, localized solution may seem convenient, initially, to an organization.

However, they present various long-term challenges, which can be alleviated through formal data masking software. Organizations can decide their chosen approach of implementing data masking based on their strategic data privacy goals, study of short- and long-term implications of both approaches and their budgetary requirements.