{"id":17670,"date":"2024-07-09T19:07:01","date_gmt":"2024-07-09T23:07:01","guid":{"rendered":"https:\/\/www.iri.com\/blog\/?p=17670"},"modified":"2025-11-12T05:38:09","modified_gmt":"2025-11-12T10:38:09","slug":"how-to-mask-pii-in-a-database","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/how-to-mask-pii-in-a-database\/","title":{"rendered":"How to Mask PII in a Database"},"content":{"rendered":"

First released in 2011, the <\/span>IRI FieldShield<\/span><\/a> database data masking tool helps you <\/span>classify, find, and de-identify<\/span><\/a> personally identifiable information (PII) or other sensitive data in structured relational database (RDB) sources. FieldShield also supports fixed and delimited files, flat XML and JSON, Excel, and ASN.1 CDR files. IRI <\/span>DarkShield<\/span><\/i> supports RDBs and other sources, too. <\/span>1<\/sup><\/a><\/span><\/span><\/p>\n

This article only summarizes the steps <\/span>FieldShield<\/span><\/i> users normally take to connect to, classify, discover, mask, and audit PII in a relational database. Below you will see links to other articles in the IRI blog which detail each of these steps. <\/span>2<\/sup><\/a><\/span><\/span><\/p>\n

This diagram represents the most common workflow:<\/strong><\/p>\n

\"\"<\/p>\n

Step-by-Step<\/b><\/h4>\n

By way of more detail, FieldShield users typically follow these steps:<\/span><\/p>\n

\"\"<\/p>\n

1. Once you have installed <\/span>IRI Workbench<\/span><\/a>, and licensed the FieldShield masking <\/span>executable<\/span><\/a>, make both JDBC and ODBC <\/span>connections<\/span><\/a> to each database to be masked. For files, identify local or remote folder locations.<\/span><\/p>\n

2. Use wizards in the data discovery<\/a> menu to profile your data sources, build E-R diagrams to model RDB schema, perform referential integrity checks, and search for specific items matching a pattern. You can find much more however using data classification (see below).<\/p>\n

3. Define data classes<\/a> (e.g., passport #, name, phone), or class groups (e.g., citizen PII) as needed, and assign to them search methods and masking functions. Then run the search wizard for your DB schema<\/a> (or file folders<\/a>). The search jobs produce log reports, dashboard charts<\/a>, and a Data Class Map<\/a> you can review before <\/i>the bulk data masking wizards use it to consistently apply your rules to your data classes (which ensures referential integrity).<\/p>\n

4. Run the <\/span>New Data Class Map <\/span><\/i>DB<\/span> Masking Job …<\/span><\/i><\/a> or the <\/span>New Data Class Map<\/span><\/i> File <\/span>Masking<\/span> Job \u2026<\/span><\/i><\/a> wizard. You will apply a default or chosen <\/span>data masking function<\/span><\/a> for each data class <\/span>based on<\/span><\/a> its need for reversibility, realism, uniqueness, consistency, and security. You can also configure these data masking jobs in mapping diagrams, 4GL scripts, or an IRI API.<\/span><\/p>\n

5. Jobs once created are easily run and modified for iterative testing, where output can first be virtualized to the console, file or sample tables for review, modification, sharing, and re-use. SQL query and update logic can be inside scripts or workflows for <\/span>real time<\/span><\/a> or <\/span>incremental<\/span><\/a> masking jobs.<\/span><\/p>\n

6. An included <\/span>risk-scoring wizard<\/span><\/a> statistically measures the likelihood that a masked data set (table) can still be used to identify an individual based on quasi-identifying information in the row.<\/span><\/p>\n

7. Further masking jobs can address the risks exposed in the scoring report by <\/span>blurring or bucketing<\/span><\/a> quasi-identifying values like birthdate and age. These techniques render the data anonymous, but still fit for purpose.<\/span><\/p>\n

8. As you gain success and confidence in the above processes, and begin to satisfy production data masking needs, you should also take stock of your job performance and metadata assets (source layouts, task and batch scripts, encryption keys, etc.). Use an IRI Workbench plugin like <\/span>Git<\/span><\/a> to secure, share, version control, and track changes to your metadata.<\/span><\/p>\n

9. During and after the go-live dates, follow IRI recommendations to monitor performance, manage updates to data, conditions and software and address new use cases or audit requirements.<\/span><\/p>\n

You can mask data in your production or test schema; you define the sources, targets, and flow. The most common is ETL; i.e., read from production, masking in the engine and writing to test.<\/span><\/p>\n

Watch this video of a typical job: <\/span>https:\/\/www.youtube.com\/watch?v=ALwQA9OigK8&ab_channel=IRI-TotalDataManagement<\/span><\/a><\/p>\n

What\u2019s Next?<\/b><\/h4>\n

After FieldShield masking is performed, you can also:<\/span><\/p>\n