The fact is that too many organizations still have not taken adequate steps to protect Non-production data and comply with the Payment Card Industry Data Security Standard (PCI DSS).\u00a0 Non-production databases often store sensitive data cloned from production, and this data is often left unprotected on development servers, laptops and test instances.\u00a0 PCI DSS Requirement 3.4 mandates that stored cardholder data is protected “anywhere it is stored,” yet somehow, non-production databases are often overlooked in security plans.<\/p>\n
Data must be protected where it lives – in the database, and it is not surprising so many attacks target non-production databases.\u00a0\u00a0 Non-production data is a soft target since there is a lot more of it and fewer controls are in place.\u00a0 Furthermore, high profile thefts reveal that insiders often do most of the damage. \u00a0Sometimes the culprit is a disgruntled employee, but more often sensitive test data inadvertently ends up on a stolen laptop, is lost through outsourcing, or simply gets misplaced on account of weak or nonexistent controls.<\/p>\n
Data masking has emerged as a best practice to protect non-production data because unlike encryption, masking is able to support the entire application development lifecycle. \u00a0Data masking removes personally identifiable information such as a person’s name and account, credit card, or social security number, and transforms it into contextually accurate, albeit fictionalized, data. \u00a0By obfuscating the information, data masking de-identifies personally identifiable information. \u00a0And because it is no longer confidential, masked data is acceptable for use in nonproduction environments such as application development.<\/p>\n
The Data Masking Process<\/strong><\/p>\n But even despite best practices, many companies still do not mask non-production data. \u00a0One problem is that “small and mid-sized companies don’t have dedicated security staff to manage complicated security systems. For products to help small companies they’ve got to be dead simple to use, automate basic security functions and save them time. The product has to make their jobs easier, not be their job,” according to Adrian Lane, CTO at Securosis.<\/p>\n In the absence of an existing control process or tools to mask sensitive data, database administrators must create and maintain scripts.\u00a0 But it makes little sense to build and maintain a masking tool set in house while so many other priorities exist for scarce DBA resources.\u00a0 Furthermore, enterprise IT organizations must demonstrate the ability to mask data consistently across all application environments.\u00a0 Compliance objectives require a clear and consistent process.<\/p>\n To the relief of many, free database security software tools are finally making an overdue market entrance.\u00a0 MySQL audit plugins, free vulnerability scanners, and now, free data masking solutions are widely available. \u00a0Even more important, these free downloads are designed from the ground up to deploy fast and be easy to use. Editorial Note: This week Solix released Solix EDMS Data Masking Standard Edition, a free download enabling sensitive data to be masked across non-production instances of enterprise applications.\u00a0 The software may be downloaded and fully deployed in minutes through an easy to use four step deployment wizard. \u00a0http:\/\/www.solix.com\/products\/solix-enterprise-standard-edition\/<\/a><\/p>\n I http:\/\/breachalerts.trustedid.com\/category\/employee-data\/page\/2\/<\/p>\n \n II Pescatore, John. “High-Profile Thefts Show Insiders Do the Most Damage”. Gartner Group. (November 2002)<\/p>\n","protected":false},"excerpt":{"rendered":" Privacy.org reports that over 500 million credit card records have been breached since 2005.\u00a0 Say what?\u00a0 500 million? Last week it was reported that 400,000 clear text passwords were breached from Yahoo within a day. Yahoo spokeswoman Dana Lengkeek said "an older file" had been stolen.\u00a0 Such a breach suggests Yahoo did not mask their […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=\/wp\/v2\/posts\/5"}],"collection":[{"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5"}],"version-history":[{"count":13,"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=\/wp\/v2\/posts\/5\/revisions"}],"predecessor-version":[{"id":15,"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=\/wp\/v2\/posts\/5\/revisions\/15"}],"wp:attachment":[{"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.solix.com\/john_ottman\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"\"](\"http:\/\/www.solix.com\/john_ottman\/wp-content\/uploads\/2012\/07\/data_masking.png\" "\\"data_masking\\"")
<\/div>\n
\nCertain free software tools may impose vendor restrictions on deployment and usage, but free database security software still represents a better, faster, cheaper way to get started protecting non-production data.\u00a0 So, there really is no excuse for a non-production database breach!<\/p>\n