Customized Data Masking for ARI Fleet

Background

Companies everywhere are gathering data faster than ever. They do it because there are now so many ways to put data insights to work.

Public concern has followed, and governments with it. Strict rules now govern how a company stores personal data and how it keeps that data private.

So the same companies are taking a second look at how they define, find, and protect sensitive data, while still using it for their own analysis.

PKWARE builds software that helps a business of any size define, find, protect, and watch the sensitive data it holds. The software was built with the user in mind, and it is simple to install.

Many companies are running at full tilt within days, on the default settings alone. Some, though, have setups no default will fit.

PKWARE can be shaped to an account without waiting on product development to fold the change into the core product. What follows is one such case, at the global fleet management company ARI Fleet.

Challenges

ARI has built up a great deal of valuable data over the years, spread across three (3) large Oracle databases. Some of that data ARI judged to be sensitive, and it wanted to protect it through data masking.

ARI wanted that data masking done in particular ways. None of them was a standard feature in the products on the market.

ARI did review solutions that could handle its customization. It was not happy with any of them: they took too long to put in, they bent too little, and they cost too much.

The detail of the data masking request is what made this hard. ARI needed a solution that could support custom data masking and keep three (3) separate application databases in step with each other.

PKWARE was a good fit on both counts. It can scan large databases without a heavy spend on computing power, and it handles many data types and formats while applying custom data masking to each. Below are examples of the masking specifications ARI was looking for:

Data Masking Specification

• Mask all characters but keep the length of the original entry.
• Keep some original character values based on set criteria, and scramble the rest.
• Partial masks that include special values.
• Parse across multi-field values and replace them all with a built-in PKWARE function, while leaving certain characters unmasked.
• Retain parts of a field while masking the other values.
• Keep the original field format, and mask parts of it on business criteria.

Our Approach

PKWARE gave ARI richer features, better monitoring, and steadier results across systems than building in house would have done, and in less time. It also meant ARI did not have to pull developers off client work.

Download PDF

PKWARE has given us the confidence we need to rapidly innovate while maintaining compliance.

Use Cases

Approach

Data Discovery During ARI’s proof of concept (POC), PKWARE ran data discovery across ARI’s databases. The point was to check the tool could find the sensitive data that needed data masking.

It found over 2,000 columns in each database, 8,000+ across all three (3), that might need it.

Data Discovery

Once discovery was done, the next step was to read the findings in a business light. That narrowed the list to the fields ARI’s own masking standards called for.

The tool was then set to mask the data already in ARI’s databases. That work ran over an agreed window of two (2) months.

When it was done, the ARI team tested and checked the masking. They wanted to be sure it met their functional needs and fit their operating time windows.

For the last step, PKWARE helped automate the job by building scripts. ARI then used those scripts to fold the custom masking into normal operations, so new data is masked as it arrives.

Implementation

For Custom Functions The PKWARE Professional Services team built custom functions in Oracle PL/SQL, to PKWARE standards, for the custom masking cases. The custom masking lets ARI mask data without slowing down the development and testing already under way. How fast it was built is what kept ARI on track against a very tight deadline.

For Building Tasks The PKWARE Professional Services team built a custom Python script. It reads a file ARI prepares, holding the details of each column that needs masking: data type, length, and sensitivity class. From that it generates JSON task definitions.

The script then picks up the JSON output file and creates tasks from it through DGCL, using a custom command.

For Automated Execution The PKWARE Professional Services team also helped ARI with scripts for a fully automated, hands-off solution. Below are some of the automated solutions provided:

• Custom Invocation: A configurable listing that calls PKWARE for tasks tied to JSONs and names or IDs.
• Automatic Execution: Tasks start in order from that listing.
• Automatic Polling: PKWARE polls to check the status of running tasks.
• Graceful failure handling: Fetch the logs, read the target PKWARE tables, compile, and send an email alert.
• Notifications: An email with full results of the run, and the log file.

Results

PKWARE’s solution was worth a great deal to the ARI team. That shows most clearly against the other two paths open to it: build in house, or buy something else off the market.

Set against building in house, PKWARE won on features, on monitoring, and on holding one standard across systems. It also took less time, and it left ARI’s developers on the client work they were hired for.

Set against other vendors, three things settled it: how long it took to put in, how far it would bend, and what it cost. Here is each in turn:

Implementation Time PKWARE put the product in within a couple of months. It needed little training and few infrastructure resources. With its runtime efficiency on top of that, the rollout went quickly in ARI’s environment.

Flexibility PKWARE took the customizations in its stride and works across databases that do not match. The project was first drawn up to scan and mask three (3) databases one at a time. What PKWARE built went further, and ARI now has an automated solution folded into its daily workflow.

Cost Against in-house work or a competing vendor, PKWARE was the best value. Its cost let ARI stay focused on its core business, with no heavy spend of time or people, and still meet the goal of protecting sensitive data.

Time, flexibility, and cost are not the whole of it. DBAs and the development and operations teams can build on the PKWARE-ARI Fleet work as ARI keeps developing its applications. They can use the data freely, with data privacy measures already in place around it.