Confidentiality - Data Obfuscation

Hiding a Message

Another thing that we could do is data masking or obfuscation. When we're hiding a message, we could do it inside of some sort of code via encryption, we could do it inside of some sort of picture, video file or other type of message, or we could do data masking, where we're hiding the data, or data obfuscation.

When you look out there, data masking and obfuscation are really closely related, and so you might see some sources actually define them as the same thing, but we'll talk about the technical differences.

De-identification

PII can have different meanings out there. It all means that it identifies a specific person. Some people categorize something like a first name as being PII information, although technically it's not, not by itself anyways. There are a lot of people out there that have the name Alex, and so it doesn't necessarily identify a specific person. Now add that to a date of birth and an address, and now that becomes PII, because somebody named Alex with this date of birth and this address probably identifies a specific person. There's probably not multiple people named Alex with the same date of birth at the same address, so this now identifies that specific person.

When the information for PII is no longer needed, we should be getting rid of that information. The problem is, it could be grouped with other information. For instance, this could be some sort of survey that we sent out, and we want to keep the information about when it was sent out, some notes about it, what the number of stars were. We want to keep this information, we don't want to get rid of it. So what we can do is de-identify this record, which means that we hide the stuff that's going to identify a person out of this record. That's what de-identification is.

A Scenario for Data Masking

Let's develop a little scenario that would be very applicable to data masking. We have an application that runs up in the cloud. We have an application that our users get onto and are able to enter in data, and it has their names and has a bunch of information on it, and they utilize our systems.

But we also have this non-production system, a development system, that has a very similar environment that we develop on before we push code to our main production system. The problem is, if we don't have actual data on our development system, then it's really hard to do testing accurately. So we want data on our development databases, we want data that's going to be really close to what our production system has. What we're going to do is take a copy of our production data and move it to our development environment.

But this causes a problem, because our development environment is not as secure. So what we're going to have to do is be able to do some data masking and hide that data, so that way it doesn't have the actual real data but it very closely emulates the real data. So data masking is one of the ways we can do that. Data masking can also be called anonymizing or tokenization.

Ways to Mask Data

This right here is going to be the data that was copied from our production systems to our development systems. How are we going to secure this?

One is we could do substitution. We have a bunch of different addresses here, so what we could do is go get another database that has mimicked addresses and dump it in here instead. So we're going to substitute the real addresses for these fake addresses.

Or we could do shuffling, where we shuffle this information around so that way the addresses now resolve to different names. That has become more secure, because now it doesn't identify a specific person, it's all mixed up.

Or maybe we do randomization. Randomizing would be something like what we could do to our dates right here. We have the different dates that we have here — and this should say date here — and so whatever these dates of birth are, we could actually do some randomizing where it chooses a different month and it chooses a different year and it chooses a different day, so then it creates it and then replaces these values right here.

Then we could do encryption. Now, not encrypting in the sense that we want to actually get this information back out — that's encryption. What we could do here is we could encrypt or hash some of this data, so there are values that still exist there but they just look different. Now, this isn't a great method, because encryption means that we can unencrypt it, and that could be a problem if that information gets out there. And hash values would look a little different anyways when we're hashing this information, so it might not represent the actual information very well.

We could do null values, or delete the information. So we could just have these fields be non-existent, and then you wouldn't be able to see what the data is. Or when you put a null value in, you'd put an actual null in there, or something that is just a dummy value that's in there, and you do that for all of the records. I've certainly seen that before.

And then masking — that is where we replace it with just some asterisks or something to that effect.

Obfuscation

Sometimes data obfuscation can be seen as the same thing, that you obfuscate things so you're data masking, so it can be defined as the same thing. But obfuscation really is when you blur something or make it a lot less intelligible.

A better example of this, rather than our data example, would be something like code. Code obfuscation is when we make it so it's really hard to read the code. We add a lot of extra stuff into it, or we design our code in such a way that if you were to pick up the code it'd be hard to understand what's going on. One way we do that with code is we add extra lines, extra lines that are kind of filler that make it look like it's doing something that it's not doing, and so as you're reading through it, it becomes hard to decipher what is the real code and what is going to be the code that's just filler code. A lot of viruses will do this too, to make it so that it's a lot less intelligible and a lot less likely that those viruses are found.

Review

We went over de-identification, mainly to set up the scenario about data masking — being able to mask our data, replacing the data, shuffling the data, replacing it with null values or deleting the data. Then we also talked about obfuscation, where we actually are making things more confusing, so when you look at it it's really hard to decipher what it is that it's saying.