Implementing a Test Data Masking solution to reduce the reputational and security risk around our financial service clients PII data.

Overview

A long standing DevOps1 customer identified risk around the use of its personally Identifiable Information (PII) data. DevOps1’s data engineering practice was engaged to undertake an initial review, with the view to implement a Test Data Masking solution (TDM).

Challenges

The customer had a manual way of provisioning the non-test databases which resulted in sensitive production data in all non-prod environments including Dev. This approach was followed across 6 key applications hosted either on-prem or cloud. This risk became an issue when some communications got triggered to actual customers from non-prod environment as part of testing. The customer tried manual scripting as stop gap solution however this proved neither accurate nor scalable.

Solutions

DevOps1 undertook detailed assessment of the issue and suggested an automated data compliance approach. We did a detailed cost vs benefit analysis of leading toolsets in the market and suggested Delphix. Delphix is a leading data masking and virtualization appliance which works well within DevOps architecture and is scalable for growing data needs.

DevOps1 undertook a detailed discovery and engaged different stakeholders to come up with a data refresh and masking process. We developed masking architecture complying with customer network topology, infrastructure and security requirements while maintaining the referential integrity across multiple interconnected systems. Our customer has the capability to sanitize data in non-prod environment from a simple GUI. As this engagement is progressing and the customer is seeing value in compliance uplift, data virtualisation is being considered as part of next phase of implementation.