1. By Gregory A. Larsen Redmond SQL Saturday April 27, 2019
Static Data Masking
By Gregory A. Larsen
Redmond SQL Saturday
April 27, 2019

2. Please Thank our Sponsors:

3. Agenda Why mask our data What is Static Data Masking
Requirements for Static Data Masking
Static Data Masking Features
Limitations
Demo
Recap

4. Why masked your data Avoid accidental exposing of sensitive data
Breach’s cost US companies billions of $ annually
Increasing security posture
Simple to accomplish

5. What is Static Data Masking
permanently replacing sensitive data with meaningless values

6. Requirements for Static Data Masking
Need SSMS version 18.0 preview 5 or above
GA made available on April 24, 2019 (
Database being masked must be on version SQL Server 2012 or above

7. Static Data Masking Features
5 different Masking Methods
SSMS GUI used for identifying masking criteria
Masking criteria stored in XML file
Perform the actual static masking via SSMS GUI

8. NULL Masking Criteria Replaces column value with NULL
Returns error if column doesn’t allow NULL values

9. Single Value Replaces column with single fixed value
Fixed value must be convertible to column data type

10. Shuffle Column values are shuffled to new rows
No new data is generated
Option to maintain NULL entries

11. Group Shuffle Masking Criteria
Shuffles multiple column together
Useful for keeping related data together (i.e Address, city, and postalcode)
Can provide multiple shuffle groups on a single table
Must define unique name for each group shuffle within a table
Shuffle group names are case sensitive

12. String Composite Masking Criteria
Generates random strings along a pattern
RegEx like patterns to identify masking requirements
Allows for subsection of data to be replaced with a fixed or random string

13. Specifying Masking Criteria Using SSMS GUI

14. Masking Criteria Stored in XML

15. Limitations Does not support databases with temporal tables
Does not mask memory-optimized tables.
Does not mask computed columns, and identity columns.
Does not support Azure SQL Hyperscale databases.
Does not support geometry and geography datatypes.
Static Data Masking does not update histogram statistics
Should run UPDATE STATISTICS after cloned database created
(SQL Server only) The data and log files may still contain bits of sensitive data in unallocated memory. This data can be read using hex editor
If Static Data Masking returns an error:
Masking is suspended
Cloned database is not deleted, and may contain confidential data

16. Demo Masking Criteria Table.Column Masking Specifications
CreditCard.CreditCardNum
String Composite (replace first 10 digits with X’s).
CreditCard.SecurityCode
Single Value (replace all values with 123)
Client.ClientName
Shuffle
Client.BirthDate
Null
Client. Addr
String Composite (keep domain, but replace portion prior sign with a random value)
Client.AddrLine
Group Shuffle
Client.City
Client.PostalCode

17. Recap Masking criteria shows columns in alphabetic order
Statically masked database on same server as original DB
Backup created is not a copy only backup
GUI tool cumbersome, might consider using XML format
No way to automate the masking process

18. Resourses SQL Server documentation Article
Article

19. Questions
My contact information: