Data Masking

A persistent, pre-compiled technique where a golden copy of a production database is transformed into a masked clone. The original sensitive values are permanently replaced in the target environment.

• Mechanism: Executed as a batch ETL process before data reaches development or QA.
• Irreversibility: The masking operation is a one-way function; original values cannot be recovered from the masked copy.
• Use Case: Populating a staging database for application testing where referential integrity must be maintained across tables.

A real-time, on-the-fly obfuscation technique where sensitive data is masked in transit based on user role and access privileges, without modifying the underlying stored data.

• Mechanism: A proxy layer intercepts SQL queries and rewrites results to apply masking rules before returning them to the client.
• Reversibility: Privileged users with unmasking rights can still access original data; unauthorized users see only obfuscated values.
• Use Case: A customer support agent querying a live database sees only the last four digits of a credit card number.

A substitution method where a given input value always maps to the same masked output value across all tables and databases, preserving relational integrity.

• Mechanism: Uses a cryptographic hash or a secret lookup table to generate consistent surrogate values.
• Join Preservation: Foreign key relationships remain intact because masked keys match across tables.
• Risk: Susceptible to frequency analysis and rainbow table attacks if the mapping algorithm is weak or the secret is compromised.

A cryptographic masking technique that encrypts data while strictly preserving the original format and length of the plaintext.

• Mechanism: Uses algorithms like FF1 (AES-based) to produce ciphertext with the same character set and length as the input.
• Example: A 16-digit credit card 4111 1111 1111 1111 encrypts to 8457 2938 1029 4756—still a valid-format 16-digit number.
• Advantage: Eliminates the need to modify database schemas or application logic that validates field length and type.

The complete or partial removal of sensitive content, replacing it with constant placeholder characters rather than realistic but fake data.

• Full Redaction: Replaces the entire field with a fixed string like XXXX or [REDACTED].
• Partial Redaction: Preserves a subset of characters for verification purposes, e.g., displaying only the last four digits of a Social Security number: ***-**-1234.
• Limitation: Destroys analytical utility and referential integrity; unsuitable for development environments requiring realistic data distributions.

A non-algorithmic substitution method where a sensitive data element is replaced with a randomly generated token that has no mathematical relationship to the original value.

• Mechanism: A secure, isolated token vault stores the mapping between the original value and its surrogate token.
• Detokenization: Only authorized systems with vault access can reverse the process to retrieve the original data.
• Distinction from Masking: Unlike masking, tokenization preserves no structural similarity to the original data and is fully reversible via the vault.

A process that substitutes a sensitive data element with a non-sensitive equivalent, called a token, that has no extrinsic or exploitable meaning. The mapping between the original data and the token is stored in a secure, hardened token vault. Unlike encryption, tokens are not mathematically reversible without access to the vault, making them ideal for protecting structured data fields like credit card numbers or social security numbers in payment and CRM systems. Tokenization preserves format and data type, allowing applications to function without modification while the sensitive values remain isolated.

The processing of personal data to replace direct identifiers (name, email, ID number) with artificial pseudonyms. Unlike anonymization, pseudonymization is a reversible process if the party holds the additional information stored separately. It is a key risk-mitigation technique under the GDPR, reducing the linkability of data to a specific individual. Key characteristics include:

• Direct identifiers are replaced, but quasi-identifiers (age, ZIP code) often remain.
• The mapping table must be kept technically and organizationally separate.
• Data is still considered personal data under GDPR, but the security burden is reduced.

A rigorous mathematical framework that injects calibrated statistical noise into query results or model training. It provides a provable guarantee that the presence or absence of any single individual's data in a dataset is statistically indistinguishable in the output. The privacy loss is quantified by a parameter called epsilon (ε)—a lower epsilon means stronger privacy. This technique is used by the US Census Bureau and in federated learning systems to prevent membership inference attacks, where an adversary tries to determine if a specific record was used in training.

The process of creating artificial datasets using generative models—such as GANs (Generative Adversarial Networks), VAEs (Variational Autoencoders), or diffusion models—that retain the statistical properties, correlations, and structure of real data without containing actual individual records. This technique is critical for:

• Sharing data with third-party developers without privacy risk.
• Augmenting rare edge cases in training datasets.
• Testing software against realistic but non-production data. The primary risk is attribute disclosure if the model memorizes rare outliers from the original training set.

A data anonymization property ensuring that each released record is indistinguishable from at least k-1 other records with respect to a set of quasi-identifiers (attributes like ZIP code, age, and gender that can be linked to external datasets). Techniques to achieve k-anonymity include generalization (replacing specific ages with ranges) and suppression (removing outlier values). While foundational, k-anonymity is vulnerable to homogeneity attacks (when all k records share the same sensitive value) and background knowledge attacks, leading to more robust successors like l-diversity and t-closeness.

A cryptographic scheme that allows computation directly on ciphertext, generating an encrypted result that, when decrypted, matches the output of operations performed on the plaintext. This enables a third party to perform AI inference or training on encrypted data without ever seeing the raw inputs. Types include:

• Partially Homomorphic Encryption (PHE): Supports only addition or multiplication.
• Somewhat Homomorphic Encryption (SHE): Supports limited operations.
• Fully Homomorphic Encryption (FHE): Supports arbitrary computation but incurs massive computational overhead (10,000x+ slowdown).