Implementing Dynamic Data Masking Techniques

Apply masking functions like redaction, hashing, and tokenization to sensitive fields to prevent unauthorized access while maintaining data utility for analytics.

In this lesson, you will learn how to apply dynamic data masking (DDM) to obfuscate sensitive information at query time, ensuring data security without permanently altering your underlying data lake or warehouse files.

The Logic of Dynamic Masking

Dynamic Data Masking acts as a security layer between the raw storage and the end-user. Unlike static masking, which physically transforms data during an ETL process, dynamic masking intercepts a SELECT statement and applies a transformation function based on the user's permissions. This allows data scientists to perform statistical analysis on masked fields while preventing them from seeing the actual PII (Personally Identifiable Information).

Applying Masking Techniques

Depending on the analytic use case, you should choose the transformation that maintains the highest possible data utility:

Redaction: Replaces the data with a static character (e.g., XXXX-XXXX) or nulls it out. Use this for fields like passwords or CVVs where the value is never needed for analysis.
Hashing: Converts the input into a fixed-length string using a one-way cryptographic function (like SHA-256). This is excellent for joining datasets on a user ID without exposing the actual email address or Social Security number.
Tokenization: Replaces sensitive data with a non-sensitive substitute (token) via a secure vault. This is reversible by authorized services but appears as an opaque string to unauthorized users.

Consider this SQL-based logic applied at the database level:

-- Applying mask based on user roles defined in ABAC
CREATE MASKING POLICY email_mask AS (val string) -> CASE
  WHEN CURRENT_ROLE() IN ('DATA_STEWARD', 'ADMIN') THEN val
  ELSE REGEXP_REPLACE(val, '(?<=.).(?=[^@]*?@)', '*') 
END;

In this example, only authorized stewards see the full email; analysts see a partially masked version (e.g., j***@domain.com). By applying these policies at the schema level, you decouple the security logic from the analytics code, ensuring that your data governance policies are consistently enforced regardless of which BI tool or compute engine is querying the data.

Key Takeaway: Dynamic Data Masking preserves data utility by transforming sensitive fields at read-time, allowing you to enforce strict privacy compliance without creating redundant, static copies of your data.