Shield sensitive fields with Dynamic Data Masking for Microsoft SQL | Data Exposed MVP Edition
Karen Lopez walks through Dynamic Data Masking (DDM) for Microsoft SQL, including the new regex-based masking capabilities for more customized masks.
Overview
With the new regex support for Dynamic Data Masking, you can provide more customized masks to protect sensitive data while still meeting data requirements with minimal impact on performance.
What the video covers
Scenario setup
- Introduces a scenario involving a customer service representative (“Bobbie Lookup”) who needs access to customer data to do their job, but should not see full sensitive values.
What Dynamic Data Masking is
- Explains Dynamic Data Masking as a way to obscure sensitive fields at query time for users who should not see the full value.
- Positions DDM as a practical control for limiting exposure of sensitive data in typical application and reporting workflows.
Deciding between encryption and masking
- Discusses how to choose between encryption and masking.
- Frames masking as a way to reduce exposure while keeping data usable, and contrasts it with encryption as a different control with different goals and trade-offs.
How Dynamic Data Masking works
- Explains the mechanics of how masking is applied.
- Demonstrates DDM in action.
Dynamic Data Masking functions
- Reviews available masking functions.
- Shows masking with default behaviors.
New regex masking capabilities
- Demonstrates masking using regex-based rules.
- Shows a demo specifically focused on regex masking.
Best practices and pitfalls
- Covers best practices for setting masking at user levels.
- Calls out an important limitation: ad hoc query access can still reveal data, so masking must be paired with appropriate access controls.
- Discusses how masking behaves with reporting and the benefit of defining it once.
Links and resources from the description
- Blog: www.DataModel.com
- Newsletter: Data Security Notes https://www.linkedin.com/newsletters/teamdata-security-notes-7079878047797051392
- MVP program: https://aka.ms/mvpprogram
- Data Exposed MVP Edition playlist: https://aka.ms/dataexposedmvps
- Data Exposed playlist: https://aka.ms/dataexposedyt
- Microsoft Azure SQL channel: https://aka.ms/msazuresqlyt
- Microsoft SQL Server channel: https://aka.ms/mssqlserveryt
- Microsoft Developer channel: https://aka.ms/microsoftdeveloperyt
Video chapters
- 0:20 Intro to Karen Lopez
- 0:47 Scenario introduction - Bobbie Lookup, customer service representative
- 2:25 What is Dynamic Data Masking
- 3:22 How to decide between encryption and masking?
- 4:32 How it works
- 5:03 Demo of it in action
- 5:40 Dynamic Data Masking functions
- 6:35 New Regex masking capabilities
- 8:30 Masked with defaults
- 9:00 Masked with Regex
- 11:35 Demo with Regex
- 13:20 Best practices for how to set at user levels, etc
- 14:35 Beware - adhoc query access would still work
- 16:30 How it works with reporting, define it once
- 17:20 Wrap up