In this lesson,
we are going to talk about "Implementing Data Protection
"with Data Masking".
Specifically, I'm going to show you how to design
a masking strategy.
We'll talk about how we implement
that data masking strategy, and then I'll take you
to the portal and I'll show you how it works.
So let's start with talking about a data masking strategy.
And before we get into the steps of that strategy,
it's important to understand that data masking
is not designed to keep someone out of a database.
So someone needs to be authenticated first
to get access to the database.
And once they're there,
data masking can provide an additional
light layer of protection to help secure the data
just a little bit further.
So we start with our data masking strategy
by defining the users.
Who should have access to the system?
And we do this through Synapse or Azure AD identities.
So we're using RBAC, identity access management,
to figure out who should have access to the system.
Then we're going to create our masking rules.
Now, our rules are really going to be defined
around the fields that we want to be masked.
And I'll show you what that looks like in a minute,
but basically, it comes to us
choosing columns that need to be masked.
Next, we're going to take a look at our masking functions,
and we're going to talk about how we control
the exposure of the data.
So if I'm masking a column, am I masking the entire column?
Am I only masking the first 4 letters or the last half?
What does that look like?
This is how we define the masking function.
And there are a couple of preset masking functions
that we can choose from.
The first being default.
Default is just a full mask.
It's going to hide everything in that column.
Next, we can use use our credit card mask.
This is going to hide everything but the last 4 digits.
And then we have an email mask,
and this is going to show us the first letter and then .com.
So everything else will be hidden.
Or we can use random number.
If we use random number,
it's literally going to generate a random number,
and it's going to put that in place
of whatever field or whatever data is in that column.
And then finally, there's custom.
And we can choose a custom padding string to,
at a more granular level,
decide how we want to mask a specific column.
Now, it's important to note before we jump into the portal
that this technology, this data masking,
can be used on SQL Database --which again,
not in the DP-203-- or in Synapse.
So for the DP-203, we would be talking about Synapse.
However, it's going to look very similar.
So with that, let's go ahead
and jump into the portal and take a look.
So here we find ourself in the portal,
and what you do is you scroll down into Security,
and you'll see dynamic data masking.
So at the start,
it's going to give you a list of recommended fields.
And it's going to give you an option to add masks to those.
Or we can create our own mask.
And so let's just go ahead and create our own unique mask.
And so first, it's going to ask me to pick my schema.
And then from there, I pick the table that I want.
And then from there,
I'm going to choose the column that I'm interested in.
So you can see from our address ID here
that we can choose Default or Number.
There's no letters in this,
and so we can't choose any of the letter strings.
But let's say that we changed it to City.
If this is the case, now we can choose our email,
or custom string, or credit card value.
So we can choose different options
based upon the column that we're looking at.
All right?
So it's really as simple as picking the column,
choosing the type of mask that we want to apply,
and then applying that.
And if we want to use custom, you can see,
this is going to tell us what exposed prefixes we have,
what exposed suffixes we have.
So how many letters or numbers at the start or finish
of our string.
And then we can choose the type
of padding string that we want to employ.
All right, we would just simply choose our column,
choose our masking field, click on the Add button.
And then it's going to add
-: -here's our add, right here-- our mask.
All right, so just a couple of key points to remember.
One, security level.
So this is a blended strategy.
Don't use masks as your only access point into Azure.
It's not designed to do that.
It's designed to be used
after someone's already authenticated themselves
and passed through the other defense layers
to get to the database.
Data masking does not change the database.
That's a very important point.
When we look at those masks,
it's just simply putting a mask over top,
think like tape, over top of what is beneath it, the data.
It's not going to actually change
your data in the database.
Pretty short lesson, but pretty important lesson.
Make sure, for the DP-203,
that you understand the different types of mask
that you could employ,
and then make sure you understand the concept
of the security and what you're actually doing
when you mask.
If you've got that down, congratulations.
I'll see you in the next lesson.