Information Obfuscation: Protecting Corporate Data

BT10
Concurrent Session
11/8/2012 3:45 PM

"Information Obfuscation:
Protecting Corporate Data"

Presented by:
Michael Jay Freer
Quality Business Intelligence

Brought to you by:

340 Corporate Way, Suite 300, Orange Park, FL 32073
888‐268‐8770 ∙ 904‐278‐0524 ∙ sqeinfo@sqe.com ∙ www.sqe.com

Michael Jay Freer
Quality Business Intelligence
Michael Jay Freer is a consultant specializing in business intelligence solutions. He has
provided thought leadership and consulting services to Fortune 500 companies including
MetLife, Tyco Safety Products, Capital One, Brinks Home Security, Rite Aid, and Zales. With
more than twenty years of experience, Michael Jay has worked with business sponsors to
provide solutions in financial, marketing, manufacturing, supply chain management, retail, and
hospitality/cruise/tourism industries. A member of the PMI, IIBA, and ASQ, Michael Jay serves
on the board of the South Florida Chapter of the Data Warehouse Institute.

Tuesday, September 04, 2012

Information Obfuscation

(Data Masking)
Protecting Corporate Data-Assets
Presented by Michael

Jay Freer

Michael Jay Freer - Presenter Bio
Michael Jay Freer, SSGB, ITIL(v3), Information Management professional providing
thought leadership to fortune 500 companies
including MetLife Bank, Tyco Safety Products,
Capital One, Brinks Home Security, and Zales.
Over his 25+ years experience he has worked with
business executives providing solutions in
financial management, manufacturing, supply
chain management, retail, marketing, and hospitality industries.
As an Enterprise Architect at MetLife Bank, Michael Jay specialized in
Information Obfuscation facilitating project solutions for protecting
business Confidential and Restricted data.

MJFreer@QualityBI.com
(954) 249-1530

Michael Jay Freer (MJFreer@Comcast.net)
(954) 2491530

Michael Jay Freer

Slide# 2
All rights reserved

1



Presentation Ground Rules
Start and Finish on time
Questions at anytime
Parking lot for longer discussion points
“Electronics on Stun”
Respect your peers
No phone calls or email in the room

(954) 249-1530

Michael Jay Freer

Slide# 3
All rights reserved

(Data Masking)
Protecting Corporate Data-assets

(954) 2491530

2



Agenda
Outlining the Problem
Data Masking Golden Rule
Defining Information Obfuscation
Information Classification
Who is Responsible
Defining a Common Language
Data-Centric Development
Governance
(954) 249-1530

Michael Jay Freer

Slide# 5
All rights reserved

Problem Statement
Corporate Data breaches are occurring at an alarming rate.
1) It is incumbent on organizations to protect the customer,
partner, and employee data with which they are entrusted.
2) Ease of access to sensitive information in business systems.
3) Using unmasked Confidential and Restricted data in nonproduction environments exposes risks to company reputation.

Business Rationale for Obfuscating Data
• Reduce Data Breach Risks
• Heightened Legal and Regulatory Scrutiny of Data Protection

Services (i.e.: SOX, HIPAA, GLBA, NPPI, FFIEC, PCI-DSS)
• Company Policies and Standards
• Fundamental assumption on the part of customers that their data

is already de-identified in non-production systems
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 6
All rights reserved

3



Problem Statement
Corporate Data breaches are occurring at an alarming rate.
1) It is incumbent on organizations to protect the customer,
partner, and employee data with which they are entrusted.
2) Ease of access to sensitive information in business systems.
3) Using unmasked Confidential and Restricted data in nonproduction environments exposes risks to company reputation.

Business Rationale for Obfuscating Data
• Reduce Data Breach Risks
• Heightened Legal and Regulatory Scrutiny of Data Protection

Services (i.e.: SOX, HIPAA, GLBA, NPPI, FFIEC, PCI-DSS)
• Company Policies and Standards
• Fundamental assumption on the part of customers that their data
is already de-identified in non-production systems
(954) 249-1530

Michael Jay Freer

Slide# 7
All rights reserved

To put Information-obfuscation (Data-masking) into
perspective simply think about yourself:
How many vendors or service-providers have your
personal information (banks, mortgage holders
physicians, pharmacies, retailers, schools you applied
to, utilities, cellular carriers, internet providers, etc.)?

Michael Jay’s Data Masking Golden Rule
“Do unto your company’s corporate data assets as you
would have your banker, healthcare provider, or retailer
do unto your personal information.”
(Use this as your compass to navigate)
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 8
All rights reserved

4



To put Information-obfuscation (Data-masking) into
perspective simply think about yourself:
How many vendors or service-providers have your
personal information (banks, mortgage holders
physicians, pharmacies, retailers, schools you applied
to, utilities, cellular carriers, internet providers, etc.)?

Michael Jay’s Data Masking Golden Rule
“Do unto your company’s corporate data-assets as you
(Use this as your compass to navigate)
(954) 249-1530

Michael Jay Freer

Slide# 9
All rights reserved

Defining Information Obfuscation
Definition
Information Obfuscation is the effort in both business
operations and non-production systems to protect business
confidential and restricted data from easy access or
visibility by unauthorized parties.

Framework
For our purposes, obfuscation includes access
management, data masking, encryption of data-at-rest
(DAR) and encryption of data-in-transit including
principles for protecting business communications.
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 10
All rights reserved

5



Sensitive Data
“Sensitive” is a broad term for information considered to be
a business trade-secret; or consider “private” by regulatory
rule, legal act, or trade association (i.e.: GLBA, HIPAA,
FFIEC, PCI, PHI, PII).

(954) 249-1530

Michael Jay Freer

Slide# 11
All rights reserved

Information Classification Levels
Public – non-sensitive data, disclosure will not violate
privacy rights
Internal Use Only – generally available to employees and
approved non-employees. May require a non-disclosure
agreement.
Confidential – intended for use only by specified employee
groups. Disclosure may compromise an organization,
customer, or employee.
Restricted – very sensitive, intended for use only by named
individuals.
Sealed – extremely sensitive, irreparable destruction of
confidence in and reputation of the organization
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 12
All rights reserved

6



Information Classification Levels
Public – non-sensitive data, disclosure will not violate
privacy rights
Internal Use Only – generally available to employees and
approved non-employees. May require a non-disclosure
PII (Personally Identifiable Information) will
agreement.
vary based on your company, your industry,
Confidential – intended for use only by specified employee
government regulations, and jurisdiction.
groups. Disclosure may compromise an organization,
customer, or employee.
Restricted – very sensitive, intended for use only by named
individuals.
Sealed – extremely sensitive, irreparable destruction of
confidence in and reputation of the organization
(954) 249-1530

Michael Jay Freer

Slide# 13
All rights reserved

Who is Responsible

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 14
All rights reserved

7



Who is Responsible
You are!
No matter your role in the organization, you are
responsible for protecting the “corporate data-assets.”

(954) 249-1530

Michael Jay Freer

Slide# 15
All rights reserved

Who is Responsible
You are!
No matter your role in the organization, you are
responsible for protecting the “corporate data-assets.”

Everyone else is also Responsible
All of your peers are also responsible for protecting the
Corporate Data-Assets.
However, you don’t have control over your peers, only
over your own vigilance and how you make your
management aware of any concerns, risk, or issues with the
security of the corporate data-assets.
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 16
All rights reserved

8



Information Obfuscation (or Data Masking) is the practice
of concealing, restricting, fabricating, encrypting, or
otherwise obscuring sensitive data.
This is usually thought of in the context of non-production
systems but it really encompasses the full information
management lifecycle from on boarding of data to
developing new functionality to archiving and purging
historical data.

(954) 249-1530

Michael Jay Freer

Slide# 17
All rights reserved

Communication
The Business-Information Owner, Project Stakeholders,
Development Teams, and Support Teams need to use a
common language when discussing the various obfuscation
methods and where in the environment lifecycle an action
will occur.

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 18
All rights reserved

9



Communication
The Business-Information Owner, Project Stakeholders,
Development Teams, and Support Teams need to use a
common language when discussing the various obfuscation
methodssimple phrasethe environment lifecycle an action
The and where in ‘Just mask the data’ does
will occur.
not address what to mask, how to mask, where to

mask, or who is responsible for understanding
the impact masking will have on business
functionality.

(954) 249-1530

Michael Jay Freer

Slide# 19
All rights reserved

Common Language – Environment Lifecycle
Common Environments
1. Development – Code is created, modified and unit tested
2. Testing / QA – System, integration, & regression testing
3. User Acceptance (UAT) – Business-user validation

Test new business requirements and regression test
existing functionality
4. Business Operations – Day-to-day business

environment
5. Business Support – Replicate and troubleshoot business

issues
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 20
All rights reserved

10



Common Environments
1. Development – Code is created, modified and unit tested
2. Testing / QA – System, integration, & regression testing
3. User Acceptance (UAT) – Business-user validation
Question for Another Time

Test new business requirements and regression some
“Which of these environments will hold test
existing functionality

level of “sensitive-data” and which are

4. Business Operations – Day-to-day business
maintained as “Production Environments?”

environment
5. Business Support – Replicate and troubleshoot business

issues
(954) 249-1530

Michael Jay Freer

Slide# 21
All rights reserved

Other Possible Environments
Isolated On-boarding – When data from 3rd party
partners are transitioned in, there may requirements for a
secured environment to cleanse and prepare data for
integration into the business operations environments
Isolated Data-Masking – Unmasked Confidential and
Restricted Data should not be transferred to nonproduction environments. A separate secure environment
allows for standardized data masking in-place

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 22
All rights reserved

11




(954) 249-1530

Michael Jay Freer

Slide# 23
All rights reserved

Example
integration into the business operations environments.
A mortgage service provider staging loans when
Restricted Data should not be transferred to nonthe servicing responsibility has not officially
production environments. A separate secure environment
transferred.

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 24
All rights reserved

12



Example
integration into the business operations environments.
A mortgage service provider staging loans when
Restricted Data should not be transferred to nonthe servicing responsibility has not officially
transferred.

Do you consider this to be “production data?”

(954) 249-1530

Michael Jay Freer

Slide# 25
All rights reserved


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 26
All rights reserved

13



Isolated Data-Masking – Unmasked Example and
Confidential
Company policies often state sensitive data may
Restricted Data should not be transferred to nonnot be stored in non-production environments.
Moving standardized data masking in-place
allows for data to “development” or “test” environments
before masking would violate such company policies.

(954) 249-1530

Michael Jay Freer

Slide# 27
All rights reserved


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 28
All rights reserved

14



Common Language – Masking Taxonomy
Methods of Obfuscating Information
Pruning Data
Concealing Data
Fabricating Data
Trimming Data
Encrypting Data
Separating Data

(954) 249-1530

Michael Jay Freer

Slide# 29
All rights reserved

Pruning Data
Concealing Data
Fabricating Data
Trimming Data
Encrypting Data
Separating Data

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 30
All rights reserved

15



Data Movement
Encrypted

Data Storage

Encrypted
Encrypted

Development Environment

Common Language – Where to Obfuscate

Data Movement – Data can be removed, shorten, or encrypted
Data Stores – Data can be encrypted , data-at-rest (DAR)
Interactive User Interfaces – Only show required data or portions
of attributes for identification (i.e. account#, license#, SS#)
Static Reporting – More restrictive than Interactive User Interfaces
(954) 249-1530

Slide# 31
All rights reserved

Michael Jay Freer

Data Movement
Encrypted

Data Storage

Encrypted
Encrypted



(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 32
All rights reserved

16



Data Movement
Encrypted

Data Storage

Encrypted
Encrypted



(954) 249-1530

Slide# 33
All rights reserved

Michael Jay Freer

Data Movement
Encrypted

Data Storage

Encrypted
Encrypted



(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 34
All rights reserved

17



Data Movement
Data Storage

Encrypted

Encrypted

Encrypted



(954) 249-1530

Michael Jay Freer

Slide# 35
All rights reserved

Pruning Data
Concealing Data
Fabricating Data
Trimming Data
Encrypting Data
Separating Data

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 36
All rights reserved

18



Data Movement
Data Storage

Encrypted

Encrypted

Encrypted


Common Language – Pruning Data

Pruning Data: Removes sensitive data from attributes
in non-production environments. The attribute will still
appear on data entry screens and reporting but be left blank.
(954) 249-1530

Slide# 37
All rights reserved

Michael Jay Freer

Data Movement
Encrypted

Example

Executive Salaries: Employee personnel records

Data Storage

Encrypted
Encrypted


Common Language – Pruning Data

can de-identify by changing Emp#, SS#, from attributes
Pruning Data: Removes sensitive data& names but
executive management records are attribute will still
in non-production environments. Theeasily tied back to
the on data entry hierarchy (e.g., top 10 salaries).
appearorganizational screens and reporting but be left blank.
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 38
All rights reserved

19



Data Movement
Data Storage

Encrypted

Encrypted

Encrypted


Common Language – Concealing Data

Concealing Data: Removes sensitive data from user
access and visibility. For data entry screens and reports, the
attribute does not appear at all versus being Pruned (blank).
Concealing data depends on clear rules for Access, Authentication, and
Accountability.
(954) 249-1530

Slide# 39
All rights reserved

Michael Jay Freer

Data Movement
Encrypted

Example

Data Storage

Encrypted
Encrypted


Common Language – Concealing Data

Bank / Loan Account#: Bank web sites generally

Concealing Data: Removes sensitivethe accountuser
do not display account numbers even to data from
access and visibility. For data entry screens and reports, the
holder.
attribute does not appear at all versus being Pruned (blank).
Concealing data depends on clear rules for Access, Authentication, and
Accountability.
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 40
All rights reserved

20



Data Movement
Data Storage

Encrypted

Encrypted

Encrypted


Common Language – Fabricating Data

Fabricating Data:
1) Creating data to replace sensitive data
2) Creating data to facilitate full functional testing
3) Creating date for negative testing (error handling)
(954) 249-1530

Slide# 41
All rights reserved

Michael Jay Freer

Data Movement
Data Storage

Encrypted
Encrypted

Example

Contact ame or ID#:

Encrypted


Common Language – Fabricating Data

Replacing contact name and ID# is the standard
Fabricating de-identifying customer and employee
method for Data:
records.
1) Creating data to replace sensitive data
2) Creating data to facilitate full functional testing
3) Creating date for negative testing (error handling)
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 42
All rights reserved

21



Data Movement
Data Storage

Encrypted

Encrypted

Encrypted


Common Language – Trimming Data

Trimming Data: Removes part of an attribute’s value
versus Pruning which removes the entire attribute value.

(954) 249-1530

Slide# 43
All rights reserved

Michael Jay Freer

Data Movement

Social Security# and Credit Card#:

Encrypted

Example

Data Storage

Encrypted
Encrypted


Common Language – Trimming Data

Changing
TrimmingSSN# from 123-45-6789 toan attribute’s value
Data: Removes part of XXX-XX-6789
(or a new attribute = 6789) so that only part of the
versus Pruning which removes the entire attribute value.
information is available, usually for identification.

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 44
All rights reserved

22



Data Movement
Encrypted

Data Storage

Encrypted
Encrypted


Common Language – Encrypting Data

Encrypting Data: Encryption can be done at the
attribute, table, or database levels
(Encrypted data can be decrypted back to the original value)
(954) 249-1530

Slide# 45
All rights reserved

Michael Jay Freer

Example
Data Storage

Encrypted

Credit Card#: Credit card numbers are often encrypted

Data Movement

Encrypted


Common Language – Encrypting Data

Encrypted

for data transmission for PCI DSS compliance.
Encrypting credit card numbers at rest (DAR) provides
additional security.
Credit Card# is Data: Encryption can that often falls
Encrypting an example of an attribute be done at theinto
multiple Obfuscation Methods.

attribute, table, or database levels
(Encrypted data can be decrypted back to the original value)
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 46
All rights reserved

23



Move Sensitive Data
to a Secured Table

Common Language – Separating Data

Data Separation: Moves sensitive data into multiple
tables. Data can still be joined but Sensitive and Nonsensitive attributes do not reside in a single record.
(954) 249-1530

Michael Jay Freer

Slide# 47
All rights reserved

Move Sensitive Data
to a Secured Table


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 48
All rights reserved

24



Move Sensitive Data
to a Secured Table


(954) 249-1530

Michael Jay Freer

Slide# 49
All rights reserved

Move Sensitive Data
to a Secured Table


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 50
All rights reserved

25



Move Sensitive Data
to a Secured Table


(954) 249-1530

Michael Jay Freer

Slide# 51
All rights reserved

Move Sensitive Data
to a Secured Table


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 52
All rights reserved

26



Move Sensitive Data
to a Secured Table


(954) 249-1530

Michael Jay Freer

Slide# 53
All rights reserved

Move Sensitive Data
to a Secured Table


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 54
All rights reserved

27



Move Sensitive Data
to a Secured Table


(954) 249-1530

Michael Jay Freer

Slide# 55
All rights reserved

Move Sensitive Data
to a Secured Table


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 56
All rights reserved

28



Prune – Removes values from non-production systems. Attribute
appears on data entry screens and reporting but are blank.
Conceal – Removes sensitive data from user access or visibility. For
data entry screens and reports, the attribute may not appear at all or be
obscured versus being Pruned (blank).
Fabricate – Creating data to replace sensitive data and facilitate
proper application testing.
Trim – Removes part of a data attribute’s value (Pruning removes the
entire attribute value)
Encrypt – Unlike Fabricated Data, encrypted data can be decrypted
back to the original value.
Data Separation – Moves specific segments of data or individual
datum into separate tables / databases to limit user access or visibility
(954) 249-1530

Michael Jay Freer

Slide# 57
All rights reserved

Development Staff

Quality Assurance

Issue Support Staff

Business End-User Access

Matrix – Method, Environment, Access

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 58
All rights reserved

29




User Groups

Development Staff

Quality Assurance

Issue Support Staff


Environments

Obfuscation Method

(954) 249-1530

Michael Jay Freer

Slide# 59
All rights reserved

No Access to Data

Development Staff

Quality Assurance

Issue Support Staff



(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 60
All rights reserved

30



Last Four Digits

Development Staff

Quality Assurance

Issue Support Staff



(954) 249-1530

Michael Jay Freer

Slide# 61
All rights reserved

Fabricate Data

Development Staff

Quality Assurance

Issue Support Staff



(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 62
All rights reserved

31



Not Acknowledged

Development Staff

Quality Assurance

Issue Support Staff



(954) 249-1530

Michael Jay Freer

Slide# 63
All rights reserved

Development Staff

Quality Assurance

Issue Support Staff



(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 64
All rights reserved

32



Projects that center around data analysis (i.e.: dashboards, BI,
data-marts / warehouses, etc.) often claim that they must have
“production data” to develop the solution.
It is true that the business will need production data for user
acceptance testing (UAT) but let’s consider a few other facts:
1) Negative testing will require fabricated data
2) New functionality will also likely require fabricated data
3) Existing production data may not contain all possible values
or permutations of data so full positive testing will also
require some level of fabricated data
4) Full regression testing will require a standardized test set
including the items above and is likely to be a combination of
fabricated and masked data
(954) 249-1530

Michael Jay Freer

Slide# 65
All rights reserved

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 66
All rights reserved

33



(954) 249-1530

Michael Jay Freer

Slide# 67
All rights reserved

If your source data has already been cleansed, how would
youpermutations of data so full positive testing will also
test for exceptions (negative testing)?
or
Based on functional-requirements, negative tests should
4)be created for everything outside a standardized test set
Full regression testing will require expected ranges.
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 68
All rights reserved

34



or permutations of data so full positive and as regulations
As systems become more complex testing will also
require some level of fabricated datadata sets for situations
increase, functional tests require
not yet present within the production data.
(954) 249-1530

Michael Jay Freer

Slide# 71
All rights reserved

4) Full regression testing will require a standardized test set,
including the items above, and is likely to be a combination
of fabricated and masked data (de-identified records)
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 72
All rights reserved

36



3) Existing production data may not contain all for source
Leverage test-datasets already created possible values
systems.
4) Full regression testing will require a standardized test set,
including the items above, and is likely to be a combination
of fabricated and masked data (de-identified records)
(954) 249-1530

Michael Jay Freer

Slide# 73
All rights reserved

Governance
Data stewardship is a key success factor for good data
governance and in this case for good information
obfuscation.
No one person will be aware of every government
regulation, trade association guideline, business functional
requirement, or company policy.
Include representatives from data stewardship, security,
internal audit, and quality assurance teams in your solution
planning and project development teams.

(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 74
All rights reserved

37



Information Obfuscation Summary
1. Obfuscation occurs throughout the information lifecycle

not just in non-production environments
2. Everyone is responsible for protecting the corporate data
assets and the best data security tool is vigilance
3. Use a defined language to communicate who, what,
where, when, and how obfuscation will occur
4. Make Information Obfuscation part of your
organization’s business-as-usual (BAU) processes
5. Follow Michael Jay’s Data Masking Golden Rule
(954) 249-1530

Michael Jay Freer

Slide# 75
All rights reserved


(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 76
All rights reserved

38




(954) 249-1530

Michael Jay Freer

Slide# 79
All rights reserved


“Do unto your company’s corporate data-assets as you
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 80
All rights reserved

40



Appendix

Reference Material

(954) 249-1530

Michael Jay Freer

Slide# 83
All rights reserved

Legal & Regulatory Alphabet Soup (Sampling)
GLBA – The Gramm–Leach–Bliley Act allowed consolidation
of commercial & investment banks, securities, & insurance co.
PPI – Nonpublic Personal Information - Financial
consumer’s personally identifiable information (see GLBA)
OCC – Office of the Controller of Currency regulates banks.
PCI – Payment Card Industry; defines Data Security Standard
(PCI DSS) processing, storage, or transmitting credit card info.
PHI – Patient Health Information - Dept of Health & Human
Services (“HHS”) Privacy Rule (see HIPAA).
PII – Personally Identifiable Information; used to uniquely
identify an individual. (Legal definitions vary by jurisdiction.)
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 84
All rights reserved

42



Sample Cross Reference Chart
Data Point
Customer - The Fact That an Individual is a Customer **
First, or Last Name *; Mother's Maiden Name
Country, State, Or City Of Residence *
Telephone# (Home, Cell, Fax)
Birthday, Birthplace, Age, Gender, or Race *
++
Social Security#, Account#, Driver's License#, National ID
Passport#, Issuing Country
Credit Card Numbers, Expiration Date, Credit Card Security Code
Credit Card Purchase
Grades, Salary, or Job Position *
Vehicle Identifiers, Serial Numbers, License Plate Numbers
Email - Electronic Mail Addresses; IP Address, Web URLs
Biometric Identifiers, Face, Fingerprints, or Handwriting
Dates - All Elements of Dates (Except Year +)
Medical Record#, Genetic Information, Health Plan Beneficiary#

PCI

PII
PPI PHI
X
X
X
X
X
X
X
X

X

X

X
X
X
X
X
X

* More likely used in combination with other personal data
** GLBA regulation to fall into the “Restricted” classification
+ All elements of dates (including year) if age 90 or older
++ Varies by Jurisdiction
(954) 249-1530

(954) 2491530

Michael Jay Freer

Slide# 85
All rights reserved

43

Information Obfuscation: Protecting Corporate Data

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (13)

Similaire à Information Obfuscation: Protecting Corporate Data

Similaire à Information Obfuscation: Protecting Corporate Data (20)

Plus de TechWell

Plus de TechWell (20)

Dernier

Dernier (20)

Information Obfuscation: Protecting Corporate Data