Managing SQL Server Data-Masking Policies

A data-masking policy contains a set of SQL Server table columns and the masking strategy used to mask the data.

You can manage your data-masking policies by performing any of the following operations:

• Create a new policy

• Edit an existing policy

• Clone an existing policy to create a new one

For easier management, we recommend that you have separate data-masking policies for each schema.

Best Practice: To avoid data inconsistencies, use the format-preserving data masking type for Primary Key and Foreign Key data types instead of shuffling.

Before You Begin

The Database Add-on package must be installed on the SQL client on which you will be running SQL Server data masking.

Procedure

Adding a Data-Masking Policy

1. From the CommCell Browser, expand Client Computers > client > SQL Server.

2. Right click the instance and then select All Tasks > Data Masking > Configure Policy.

   The Configure Data Masking dialog box appears.

3. In the Policy Name box, type a unique policy name.

4. From the Database list, select the database that you want to mask.

5. From the Schema list, select the schema that you want to mask.

   The software populates the Table list with the tables that are in the selected schema.

6. From the Table list, select the table that you want to mask.

   The software populates the Column box with the list of table columns.

7. To add data masking for a table, perform the following steps:

   1. In the Column box, click the Object that you want to mask. The available data masking types for the selected Object are displayed in a list in the Data Masking Type box.

   2. In the Data Masking Type box, select the data masking type.

   3. If applicable, enter the data masking inputs.

      • If you selected FIXED STRING then in the Inputs for Fixed String box, type the string that the software uses as a replacement.

      • If you selected NUMERIC_RANGE, then under Inputs for Numeric Range, in the Min and Max boxes, enter the minimum and maximum values the software uses to generate the random number.

      • If you selected NUMERIC_VARIANCE, then under Inputs for Numeric Variance, in the Max Percentage box, enter the maximum percent that the software uses to vary the data.

   4. Click Add.

   5. You can repeat the selection of additional Columns (Objects) to add from this database schema. Click Add after each set of criteria have been specified.

8. You can specify Columns from multiple tables of multiple databases in one masking policy. To do this, select additional databases in the Database box and/or new schemas in the Schema box to be added to the policy, with the desired masking criteria.

9. Click OK when you have completed the selections for all the databases and schemas you want to add to this data masking policy.

Viewing a Data-Masking Policy

1. From the CommCell Browser, expand Client Computers > client > SQL Server.

2. Right click the instance and then select All Tasks > Data Masking > Manage Policies.

   The Data Masking Policies tab is populated with a list of policies.

3. In the Data Masking Policies tab, right click the desired policy and select View.

   The policy is displayed.

4. Click OK when you have completed viewing the policy.

Modifying a Data-Masking Policy

1. From the CommCell Browser, expand Client Computers > client > SQL Server.

2. Right click the instance and then select All Tasks > Data Masking > Manage Policies.

   The Data Masking Policies tab is populated with a list of policies.

3. In the Data Masking Policies tab, right click the desired policy and select Modify.

   The Modify Policy dialog is displayed.

4. You can add new databases or schemas to the policy, or modify the columns selected for masking.

5. To delete a database and schema combination from a policy, select it in the bottom pane and click Remove.

6. Click OK when you have completed the modifications for this policy.

Cloning a Data-Masking Policy

1. From the CommCell Browser, expand Client Computers > client > SQL Server.

2. Right click the instance and then select All Tasks > Data Masking > Manage Policies.

   The Data Masking Policies tab is populated with a list of policies.

3. In the Data Masking Policies tab, right click the desired policy and select Clone.

   The Configure Data Masking dialog box appears. The Policy Name box displays the selected policy with the string "_Clone" added to the policy name. You can change this policy name if you want.

4. You can add or remove databases, schemas, and objects from this cloned version.

5. Click OK when you have completed the modifications for this policy.

Deleting a Data-Masking Policy

1. From the CommCell Browser, expand Client Computers > client > SQL Server.

2. Right click the instance and then select All Tasks > Data Masking > Manage Policies.

   The Data Masking Policies tab is populated with a list of policies.

3. In the Data Masking Policies tab, right click the desired policy and select Delete.

   A Confirmation dialog box displays, asking if you are sure that you want to delete the policy. Click Yes or No.

Result

The software creates, modifies, or deletes the data-masking policy.