Oracle Key Vault Data Subsetting and Masking
2 likes870 views
The document provides an overview of Oracle Key Vault and Data Subsetting and Masking Pack. It discusses how Oracle Key Vault can be used to centrally manage encryption keys and securely share them across databases, middleware, and systems. It also summarizes the key capabilities of Oracle Data Subsetting and Masking Pack, which can be used to discover, mask, and subset sensitive data to limit its proliferation while sharing non-sensitive data with others. The document highlights use cases, challenges, methodology, transformation types, and deployment options for data masking and subsetting.
![Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |
Masking Examples
Country Identifier
CA 226-956-324
US 610-02-9191
UK JX 75 67 44 C
Country Identifier
CA 368-132-576
US 829-37-4729
UK AI 80 56 31 D Emp ID First Name
324 Albert
986 Hussain
Emp ID First Name
324 Charlie
986 Murali
Emp ID First Name
324 Charlie
986 Murali
FIN
Health
Records
Health
Records
Company Closing Price
IBFG $36.92
XKJU ¥789.8
Company Closing Price
IBFG $89.57
XKJU ¥341.9
Generate Random Values Preserving Format
and more …
Generate Deterministic Output
HR
Mask Based on Condition
BLOB
3178973456
6509876745
Search : [0-
9]{10}
Replace : *
BLOB
**********
**********
Mask Operating System Files stored as Blobs
Shuffle Records](https://image.slidesharecdn.com/ustckeyvaultanddatamasking-161007133000/85/Oracle-Key-Vault-Data-Subsetting-and-Masking-24-320.jpg)
Oracle Key Vault Data Subsetting and Masking
- 1. Oracle Key Vault Data Subsetting and Masking Paul White Database Security Specialist
- 2. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. 2
- 3. Database Security Oracle Key Vault Overview
- 4. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Oracle Database Security Solutions Defense-in-Depth for Maximum Security Activity Monitoring Database Firewall Auditing and Reporting DETECTIVE Data Masking Privileged User Controls Encryption & Redaction PREVENTIVE ADMINISTRATIVE Sensitive Data Discovery Encryption Keys and Certificates Privilege Analysis
- 5. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Managing Master Keys in Oracle Wallet • CRITICAL: Remember wallet password • CRITICAL: Do not delete wallet. Retain copy of password-based wallet even if using auto-login • CRITICAL: Do not have multiple databases share same wallet • Set strong wallet password using numbers, capitalization, length >= 12 characters… • Rotate master encryption key and wallet password approximately every six months • Backup wallet before and after each rotation operation • Keep wallet backup separate from encrypted data backup • Restrict wallet directory and file permissions • Keep wallet read-only for daily use, set immutable bit where available • For RAC, consider storing wallet in ACFS (DB 11gR2) or ASM (DB 12cR1) • For DB 12cR1, separate duties using SYSKM
- 6. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Management Challenges: Proliferation 6 Primary Data Center Failover Data Center
- 7. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | 7 The Challenges of Key Management Management • Proliferation of encryption wallets and keys • Authorized sharing of keys • Key availability, retention, and recovery • Custody of keys and key storage files Regulations • Physical separation of keys from encrypted data • Periodic key rotations • Monitoring and auditing of keys • Long-term retention of keys and encrypted data
- 8. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Key Management with Oracle Key Vault • Centrally manage and share keys, secrets, Oracle wallets, Java keystores, and more • Optimized for Oracle stack (Database, Middleware, Systems) and Advanced Security TDE • Robust, secure, and standards compliant (OASIS KMIP) key manager 8
- 9. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | • Full-stack solution based on hardened configuration – Easy to install, configure, deploy, and patch – Open x86-64 hardware to choose from • Includes Oracle Database security options – Transparent Data Encryption, Database Vault, Virtual Private Database • Separation of duties for administrative users • Full auditing and alerts • Preconfigured reports Oracle Key Vault Software Appliance Platform 9
- 10. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Oracle Key Vault High-Level Architecture Standby Administration Console, Alerts, Reports Secure Backups = Credential File = Oracle Wallet = Server Password = Java Keystore = Certificate Databases Servers Middleware 10
- 11. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Oracle Advanced Security Transparent Data Encryption (TDE) Online Master Key Scenarios 11 Single Instance Multiple DBs Same Machine RAC Data Guard GoldenGate
- 12. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Provisioning Endpoints 12 1. One-time enrollment token 2. Endpoint package 3. Endpoint installation and configuration4. Results: Endpoint certificate, binaries and configuration file 5. Sharing
- 13. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Management Reports – Endpoint Activity 13
- 14. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | User Activity 14
- 15. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Control Keys with On-Prem Key Vault Customer DBCS 15 Customer Premise KEY VAULT • Security and availability of keys • On-premise key access control by customers • Isolation of keys per tenant • Maintain control and visibility Keys, Wallets, Credential Files
- 16. Database Security Data Subsetting and Masking Pack Technical Overview
- 17. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | SECURITY MAXIMUM SECURITY FOR CRITICAL DATA INFRASTRUCTURE Activity Monitoring Database Firewall Auditing and Reporting DETECTION Subsetting and Data Masking Privileged User Controls Encryption & Redaction PREVENTION ADMINISTRATION Sensitive Data Discovery Encryption Keys and Certificates Privilege Analysis
- 18. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |PRELIMINARY DRAFT Need to Mask and Subset Data Use Cases • Test, Dev, QA, Training, Research, Outsourced, Cloud, and more Limit Sensitive Data Proliferation • PCI-DSS, HIPAA, European Data Protection, Canada PIPEDA, and more Compliance • With Subscribers, auditors, courts, partners, testers, developers, and more Share What is Necessary Challenges • In the midst of numerous applications, databases, and environments How to Locate Sensitive Data? • Data has different shapes and forms: VISA, AMEX, Discoverer, Master, SSN, and more How to Accurately Protect Sensitive Data? • To developers, testers, applications, and more Is the Protected Data Usable? Right to be Forgotten/Erasure (New GDPR in Europe) Save Storage Costs • Non-Prod such as Test/Dev, Mega Data warehouses, and more We Do Not Have Resources? Will the Applications Continue to Work? • To develop and maintain such solution in this ever- changing IT landscape and More .....
- 19. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Oracle Data Masking and Subsetting Pack Reduces Risk in Sharing by Obfuscating or Removing Sensitive Data Discover Sensitive Data Mask Data using Format Library Subset Based on Goal/Condition Mask/Subset in Export or on Staging Modeling Application Data Mask in Workload Captures & Clones Pre-installed in Enterprise Manager 0100101100101010010010010010010 0100100100100100010010101001001 0010011100100100100100100100001 0010010111001001010100100101010 1001101010010101001000000111111 11000 SSN 463-62-9832 Credit Card 3715-4691-3277-8399 SSN 463-62-9832 576-40-7056 518-12-6157 281-50-3106 Credit Card 3715-4691-3277-8399 5136-6247-3878-3201 3599-4570-2897-4452 5331-3219-2331-9437 Production Test/Dev 555-12-1234 5555-5555-5555-4444
- 20. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Data Masking and Subsetting Methodology •Discover sensitive data •Discover data relationships Create Data Model •Masking formats and templates •Goals & conditions for subsetting Select Formats & Criteria •Preview masking algorithm results •Preview subset reduction results Preview & Validate •In-Database or In- Export •Rerun with same data model Execute Transformation 21
- 21. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Application Data Modeling Sensitive Data Discovery Automated Discovery Data Relationships Sensitive Columns Metadat a Target Database
- 22. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Extensive Masking Format Library • Provides common masking formats • Supports custom masking formats – Random numbers/strings/dates – Substitute – User defined PL/SQL function … and more • Generates sample masked values • Templates for specific versions of E-Business Suite and Fusion Applications
- 23. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Comprehensive Masking Transformations Conditional masking Masks rows differently based on condition E.g. Mask national identifiers based on country Consistent masking Ensures the masked values is same across multiple databases E.g. Mask employee identifiers consistently across schemas and databases Compound masking Reduces masking time by grouping related columns E.g. Mask related columns: address (street, state, country), or dates (birth , joining) Format preserving Generates random values that maintain the original format E.g. Mask passport numbers or tax identifiers while keeping the format Perturbation Generates random values within a user defined range E.g. Generate random dates within a specific range Shuffling Shuffles the values within a column E.g. Shuffle clinical data or PII between electronic health records Reversible masking Encrypts and decrypts data based on a passphrase E.g. Outsourced data processing team can unmask data 24
- 24. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Masking Examples Country Identifier CA 226-956-324 US 610-02-9191 UK JX 75 67 44 C Country Identifier CA 368-132-576 US 829-37-4729 UK AI 80 56 31 D Emp ID First Name 324 Albert 986 Hussain Emp ID First Name 324 Charlie 986 Murali Emp ID First Name 324 Charlie 986 Murali FIN Health Records Health Records Company Closing Price IBFG $36.92 XKJU ¥789.8 Company Closing Price IBFG $89.57 XKJU ¥341.9 Generate Random Values Preserving Format and more … Generate Deterministic Output HR Mask Based on Condition BLOB 3178973456 6509876745 Search : [0- 9]{10} Replace : * BLOB ********** ********** Mask Operating System Files stored as Blobs Shuffle Records
- 25. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Data Subsetting Use Cases • Share relevant subset of data with internal and external teams • Reduce storage cost for test/dev • Extract subscriber data from SaaS • Perform research and analysis on a subset of data • Extract subset of data as part of e- discovery requests 26 0100101100101010010010 0100100100100100100100 1000100101010010101010
- 26. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | 010010110010101001001001 001001001001001001001000 100101010010101010101010 100101010010101010100010 100100101010101010101001 Goal or Condition Based Subsetting 100% 25% 10% 1024 GB 256 GB 102 GB 100M Rows 20M Rows 2M Rows Relative Database Size Relative Table Size Condition Based 27 Extract ASIA Sales
- 27. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | Preview and Validate Subset Results 28
- 28. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. | 01001011001010100100100100100100100100100100100010010101 00100100100111001001001001001001000010010010111001001010 10010010101010011010100101010010000001111111100001011001 0100101100101010010 0100100100100100100 1001001000100101010 010 0100101100101010010 0100100100100100100 1001001000100101010 010 Deployment Options In-Database In-Export Production Test/DevStaging Minimal impact on the production environment Production Test/DevExport Sensitive data remains within the production perimeter
- 29. Copyright © 2015 Oracle and/or its affiliates. All rights reserved. |