Masking with Delphix (where duplicate blocks are shared making a new copy almost free storage wise and almost instantaneous) has 4 big advantages
Instant data, no copying
Ease of Use
Consistent across data centers and databases vendors
Master/Slave
Virtual Data Masking
Delphix masking and virtualization is the most advanced solution in the market place, because Delphix doesn’t provision data. Instead of provisioning data, Delphix sets up pointers back to existing data for a new clone. When that new clone tries to modify data, the existing data stays unchanged, and the changed data is stored elsewhere and only visible to the clone that made the change. This allows Delphix to mask once and provision many masked copies in minutes for almost no storage.
Some tools requires to subset data. Imagine writing code to subset data from a medium size (5000 objects) custom database, and maintain it.
Some tools requires 1.5X disk in the target, because it creates temp tables to copy and mask data.
Whereas, Delphix masks in memory, no need for disk, and virtualizes the data.
Ease of use saves money
Largest cost in data masking is the personnel to develop and maintain masking code.
Most tools require significant programming skills and dedicated administrators.
DELPHIX:
Users with no programming background can use the product in 4 hours.
Web based interface with profiling integrated to masking: You can profile and start masking in minutes without any programming knowledge.
Mask data consistently
Delphix masks data consistently across different type of data sources, across different data centers automatically
Some tools either masked different data sources differently breaking referential integrity or they require the user to manually maintain relationships across all attributes and across all data sources using the ‘Translation Matrix’. Other tools based on specific databases require the user to import data into that proprietary database in order to mask it and then the data needs to be copied back out of the proprietary database into the location it is used.
DELPHIX:
The module which identifies sensitive data (Profiler), also assigns the masking algorithms, so no need to manually define relationships.
Delphix masking algorithms are deterministic, so based on the input we create a consistent output, regardless of the data source
Delphix architecture separates transformation from a data source
Master/Slave configuration
Delphix provides a central interface to configure/manage users, metadata and algorithms, and execute masking in a consistent and distributed manner for each department, entity, or data center. Without this, each entity would have masked data differently, and aggregation of data would be useless.
Next Steps
Pete Finnigan recently did a paper reviewing of Delphix and data masking where he points out some of the challenges to masking and solutions.
Pete goes into ways of securing the source database such that the cloned copy benefits from the security in the source. Pete also shares some of the top reasons he has heard at customer sites for why people don’t mask even though they want to.
The top 5 reasons people don’t mask when they should
Fear of not locating all data to mask
Referential integrity
Data distribution
Testing may not be valid with masked data
Time, cost and skills needed
Pete has done a second paper on specifically how to secure data in non production areas. We will be publishing this paper soon.
Pete’s first paper with Delphix on masking is available here.