Forum Discussion
How classifying the dynamic data masking algorithms
Hi,
I need to understand how classifying the algorithms (default, email, random, partial) related to the dynamic data masking feature: Dynamic data masking in Fabric data warehousing
So, are these data anonymization or substitution or shuffling or redaction or other ones? Thanks
4 Replies
Hi pmscorca,
In fact, this feature not affect the actual data in database, it only apply the rule to format the query result to limit exposure of sensitive data.
Notice:1. dynamic data masking doesn't aim to prevent database users from connecting directly to the database and running exhaustive queries that expose pieces of the sensitive data.
2. Unprivileged users with ad hoc query permissions can apply techniques to gain access to the actual data. (e.g. DDM enabled on Salary field, users apply T-SQL statement with conditions to query data within specific number range) For this scenario, you may need to apply auditing to monitor all database activity and mitigate this scenario.
Regards,
Xiaoxin Sheng
Hi,
I need to classify the dynamic data masking functions respect to the reference literature, thanks.
Hi pmscorca,
In fact, they are different type of masking rules.
For default function, it will output the default value based on column definition instead actual value.
string types, use XXXX.
numeric types use a zero value.
date and time types, use 1900-01-01 00:00:00.0000000 .
binary types use a single byte of ASCII value 0.For Email function, it will check hte value if they are in email structure and mask the value after the first charater and constant suffix before '.com'. (e.g. [email protected])
For Random function, it will return a random value between the define number range.
For custom string, it will make after first character and before the last charter based on custom padding string in the middle. (prefix,[padding],suffix)
Dynamic data masking in Synapse Data Warehouse - Microsoft Fabric | Microsoft Learn
Regards,
Xiaoxin Sheng
