In this chapter we are going to a make a thoroughly comprehensive analysis of data masking and the research done so far on the subject.
We will take a look at the principles and objectives along with the methods used so far to protect our data through masking and finally we will examine the best practices used when carrying out data masking.

%\section{Definition and significance}

%\section{Principles and Objectives of data masking}

\section{The five laws of data masking}

\begin{enumerate}
    \item \textbf{Masking is irreversible} The original information we are masking can not be retrieved from the masked result.

    \item \textbf{The result should accurately reflect the characteristics of the original data} One of the main reasons of using masking instead of just generating random values is that we need to have an outcome with similar features and attributes to the original values. An example of this law would be passing the masked result for testing developers to examine,verify and validate the program. You would need to have a sample of the data with similar aspects and not random values.  

    \item \textbf{Consistency in references must be preserved} In a database if a value is a primary key and it is masked in a certain way, we must make sure that in the other tables where that value is referenced as a foreign key should also be masked in order to maintain the consistency.

    \item \textbf{Mask non-sensitive data only when there is a possibility of reconstructing sensitive information from it} It is not mandatory to mask every element in your database; only the portions you consider sensitive require masking. However, certain non-sensitive data might still have the potential to reconstruct or link back to sensitive information. For instance, if you obscure a customer ID but other transaction details uniquely correspond to a single customer, it's essential to also mask those details. This scenario,known as inference analysis, needs to be addressed by your data masking solution to ensure comprehensive protection.

    \item \textbf{The masking procedure should be a reproducible and consistent process} Masking data just once is tough to maintain and doesn't work effectively. It is crucial to make sure that development and test data closely resemble the rapidly changing real data. Without automation, masking is inefficient and expensive \cite{goyal2015data}.
\end{enumerate}

\section{Methods of data masking}

There are diverse masking methods that works in different ways depending on use cases and scenarios. Depending of the user's policies, capacity and requirements, the company may choose to implement one accordingly. we are going to analyse most of the popular methods of data masking and give a complete picture on why the company chooses to implement one instead of the other.

\subsection{Static Data masking}

Before discussing about static data masking, I would like to look at the word "Realism". This concept is highly important in masking as data created by masking process must be realistic.
According to the oxford dictionary, Realism is a quality of representing something in a way that is accurate and true to life. We adopt this characteristics when creating our data as we need our masked data to have the same features as our real sensitive data.
An example would be masking a string to a number in a development or testing environment. This would create a testing problem as we can not handle a number as we can handle a string.
Realism is not only a concept for static data masking as also other types of masking would have the same issue if not handled cautiously.
Static data masking is a technique of masking where sensitive data are replaced permanently at rest.
This masking technique is used mostly when creating development and testing environment where real data is not necessary but fake realistic ones \cite{imperva}.

\subsubsection{How to implement static data masking}
As this masking is all about masking data at rest, we need to take the database to mask as input and apply transformation on sensitive data.
While transforming sensitive data keep in mind all the foreign key that might be referential between databases.
And lastly produce a realistic high quality data database with masked values.

\begin{figure}[!h]% per piazzare la tabella t:top b:bottom h:here, in ordine di preferenza; h è sconsigliato
\centerline{\includegraphics[width=0.9\textwidth]{static_data_masking.png}}
\caption{static data masking\label{fig:staticMaskingImage}}
\end{figure}

The figure \ref{fig:staticMaskingImage} explains graphically what we discussed above where in order to create a static data masking requires implementing the masking with the data at rest and creating a new database where those data would be stored.

\subsubsection{Advantages of static data masking}

\begin{itemize}
    \item No risk run when the masked database is exposed since there is no sensitive data. 

    \item Unlike the dynamic data masking there is no performance overhead on the masked database. In static data masking the obfuscation operation is done before the database is made available to the users. This means that there is no operation that lies between the user and the masked database that could hinder or delay the operation.

    \item Very simple to implement as it does not need to write a detailed object level security as all sensitive data has been replaced \cite{imperva}.
    
\end{itemize}

\subsubsection{Disadvantages of static data masking}

\begin{itemize}
    \item Since masking is not done in real time, it requires an ahead of time masking process which might hinder the business plans as the time it takes for completing the masking of database depends on the size of the data to mask.

    \item In some use cases, static data masking is not applicable as it modifies completely the database, we can not use it to protect the production environment.
\end{itemize}

\subsection{Dynamic Data masking}

Dynamic data masking which is the main topic of this thesis is when the masking instead of being implemented on data at rest, it is done while data is in-transit.

This means that dynamic data masking is designed to protect the data in real time. In order to have this type of masking, a proxy is required in order to handle the query and communicate with the database. The proxy lies between the user and the database system.

The advantage with dynamic data masking is that it is fine-grained and has the capacity to  provide protection basing on the roles of the user who queried the database.

\subsubsection{How to implement dynamic data masking}

In order to make a successful DDM masking operation, you need to place a proxy running the dynamic data masking function between the database and the query. Lastly you would need to implement data masking policies the DDM Tool would base it's self to provide a detailed access and masking of the data to appropriate users.

There are 2 ways the proxy returns the masked result to the user. Usually the database query masks database by modifying the query sent to the database. The other way would be to execute the query AS IS from the user but modifying the result set returned by the database.
All queries need to pass through the proxy before getting to the database.


\begin{figure}[!h]% per piazzare la tabella t:top b:bottom h:here, in ordine di preferenza; h è sconsigliato
\centerline{\includegraphics[width=0.9\textwidth]{dynamic_Data_masking.png}}
\caption{dynamic data masking\label{fig:dynamicmaskingImage}}
\end{figure}

The figure \ref{fig:dynamicmaskingImage} details how the operation involving querying the a database secured with a dynamic data masking proxy. As shown above, the user does not interact directly with the database but, he interacts with the proxy which can modify his query according to his role and the policy established. Once the query is reviewed by the proxy, it queries the database which will provide the data to the user through the query again. These data comes back to the user already protected.

\subsubsection{Advantages of dynamic data masking}

\begin{itemize}
    \item An additional and customised layer of security added to protect the data

    \item Real time protection is provided which makes it suitable to protect the data in production.

    \item Unlike static data masking that requires a certain time ahead to mask the data before presenting it to the users, in DDM, there is no processing time needed in advance for masking as everything is done in real time \cite{imperva}.
    
\end{itemize}

\subsubsection{Disadvantages of dynamic data masking}

\begin{itemize}
    \item Dynamic data masking protects the data only in read mode scenario, in case we need also to write on the same database, there might be conflict where we will write on the database masked data thus corrupting it.

    \item Compared to the static data masking there is a performance overhead as you do not connect directly to the database but you pass by the proxy.

    \item The proxy becomes a single point of failure as all the queries from the users to the database passes through it.The biggest issue with this is that if a user manages to evade using the proxy, he would get the data stored in the database with unprotected sensitive data.

    \item there is a lack of maturity for this technology as it is relatively unlike static data masking.
\end{itemize}



\section{Common data masking methods}

There are different methods to implement data masking, and depending on the type of data the company have to mask and what are the company's policy, we may choose among the following:

\subsection{Shuffling}

Similar to the substitution method the shuffling methods uses the same masking column and shuffles it in random positions.

An example would be shuffling the student's names columns across a database, and putting each name in a random position depending on the shuffling algorithm used.
The result would be similar to the original data.

The shuffling method of masking is prone to an attack, as if a malicious user knows the algorithm used, he would be able to reverse engineer the algorithm and get the original database \cite{DMtechniques}.


\subsection{Substitution}

This is the simplest form of masking where a value is simply substituted into another one of the same type.
As en example, the masking might change the person's phone number with other random phone number \cite{DMtechniques}.

\subsection{Scrambling}

Scrambling is a data masking technique where we change the order of characters in the original data. This type of masking can only work on some types of data and not others.
Due to its simplicity, scrambling technique is not very secure as someone who remembers the order of the original data can immediately be able to decipher the scrambled values.

An example would be changing the original employee ID in the production environment from ID: 67598 to ID:89576 \cite{techtarget}.

\subsection{Data variance}

The Number Variance method is an effective strategy for altering numerical or date-related data. 
This approach modifies each value in a dataset by adding or subtracting a random percentage of the value's true amount.
The primary benefit of this method is its ability to obscure the actual data while maintaining the overall scope and distribution of the dataset within its original parameters.
For instance, in a dataset containing a debt figures, each value can be customized and changed by a factor of 10 percent.


Consequently, the altered figures will remain relatively close to their true values. Similarly, 
this method is applicable to date data, such as birth dates, which can be randomly adjusted within a specified range \cite{DMtechniques}.

\subsection{Nulling out}

Nulling out is another type of data masking where data is nulled independently of which type of data. The advantage of this method is that, it is very simple and straightforward; however it has also a big drawback as data integrity is no longer present. 

This makes it especially difficult if the masked data is used for development and testing purposes as it is no longer possible to use it to different use cases possible with real data \cite{DMtechniques}.

\subsection{Masking out data}

This is a generic term that means anonymisation but it is also a masking method where data is in certain fields is replaced by a standard character usually 'X'. This perfectly masks our data at the same type keeping the format of the data as it keeps the properties it had before.

An example would be a credit card with numbers: 2234-7146-3088-6173. This same credit card number becomes 2234-XXXX-XXXX-6173.

As explained above, When we replace raw data with a character, we remove the sensitivity of the content and still preserve the format of our data, we have to be careful to know how many characters we anonymise as also which ones to mask.
This is due to the fact that, if you remove the first characters in the credit card, u will strip the possibility to recognize which type of credit card it is.
In few words, the masking of credit card as 
The masking characters effectively remove much of the sensitive content from the
record while still preserving the look and feel. It would not be hard to regenerate the original credit card number from a masking operation such as: XXXX-XXXX-XXXX-6173 would not be suitable.

Same with the masking of the last few numbers as 2234-7146-3088-61XX would be too easy to revert since credit cards use a fairly public algorithm for checksum.

 In conclusion, the decision process of making data anonymous should consider all the above risks \cite{goyal2015data}.


%\section{Deep Dive into Dynamic Data Masking (DDM)}

\section{Applications and Use Cases of Data Masking}

Data masking has different applications, but most companies go through this process with their data for security reasons.

\textbf{Legal Obligations}: the regulations in which companies have to be compliant are becoming more and more broader and specific. It's widely anticipated that the criteria for data security and management will only tighten further.

\textbf{Loss of confidence in the client trust}: in many regions, the repercussions of a data breach extend beyond regulatory penalties. 
Such incidents might not be the primary concern immediately. The fallout from data breaches, intentional or accidental, can be severe.

Consider the repercussions for an organization if potential clients hesitate to share sensitive data due to negative media coverage about a data breach.
The costs involved in managing the brand's image and addressing public concerns can significantly surpass any legal fines.
The impact on senior management, who may have to engage in damage control and reassure stakeholders, can be profound.
The financial implications of tarnishing a company's reputation often overshadow any regulatory fines.

 \textbf{Unintentional Disclosure}: the potential for inadvertent data leaks is sometimes overlooked in the context of security risks related to actual test data. 
 The assumption that masking test data is unnecessary because everyone has access to the production environment is misguided.
 
 The threat of accidental data leaks persists. Masking critical data elements (like credit card numbers or customer email addresses) can help reduce the risk of damaging leaks while maintaining the operational functionality of the databases.

 \textbf{Data utilization}: data obfuscation enables organizations to utilize representative data for the purposes of testing and development.
 By employing this technique, genuine sensitive data remains concealed, ensuring that the integrity and confidentiality of the information are upheld.
 
 This practice is crucial for verifying the proper functioning of software and systems, without compromising data security \cite{datavarsity}.

\textbf{Secure third-party data sharing:} In situations where companies are required to distribute data externally, data masking acts as a safeguard, concealing confidential elements within the data. 

This process facilitates secure information exchange and fosters collaboration between business partners, all while maintaining data privacy \cite{datavarsity}.

\textbf{Cost-efficiency:}The repercussions of data breaches can be extensive, including legal penalties, damage to reputation, and the costs of rectification.

Implementing data masking can mitigate the risk of such breaches, offering organizations a protective measure that can lead to significant savings in terms of both time and financial resources \cite{datavarsity}.

\section{Masking Constraints}

As said above, data masking hides the data but keeps the integrity of the data. However, this process can encounter several challenges, particularly when specific data properties must be preserved.
These constraints make the development of masking algorithms complex, necessitating sophisticated solutions to balance data utility with privacy \cite{archana2014applications}.
Below are key constraints identified in data masking and suggestions for enhancing clarity:

\begin{itemize}
    \item Format preservation:  the masked data must retain the same format as the original data, meaning the length and structure of the data should remain consistent. For instance, a 16-character codice fiscale must be replaced with a masked equivalent of the same length and alphanumeric composition.
    
    \item Data Type preservation: in environments like relational databases, it's crucial to maintain the data types across masked values \cite{goyal2015data}. This ensures compatibility with the database schema, preventing issues like inserting textual data into fields designated for numbers or dates.
    
    \item Gender preservation: attributes tied to gender should be masked with alternatives reflecting the same gender. This is particularly relevant for names, where a female name should be replaced with another female name, and similarly for male names.
    
    \item Semantic integrity: masking must not only preserve the format and data type but also ensure that the data remains valid under specific checks, such as a credit card number's validity criteria.
    
    \item Referential integrity: the relationships between elements across different tables or files must be meticulously maintained in the masking process to preserve data relational context and meaning.
    
    \item Aggregate Value: the overall statistical properties, such as totals or averages, of a masked dataset should closely or exactly mirror those of the original data, ensuring analytical value is not compromised.
    
    \item Frequency distribution: the masking process should accommodate the need for either random or logically consistent frequency distributions. For example, maintaining geographical relevance in datasets by preserving or logically altering pin codes to reflect realistic geographic distributions.
    
    \item Uniqueness: ensuring the uniqueness of masked values is paramount, especially for identifiers or keys that must remain unique to maintain referential integrity across database tables.

\end{itemize}

By addressing these constraints, data masking strategies can effectively secure sensitive information while preserving the utility and integrity of the masked data for various applications.


\section{Best practices in implementing data masking}

Initiate the data masking process by first pinpointing:
\begin{itemize}
    \item  Where the sensitive data resides.
    \item  Who has the clearance to view this data.
    \item  The specific use cases for the data.
\end{itemize}

It's unnecessary to mask every data element within an organization. Prioritize the precise identification of sensitive data in all environments, both production and testing. This identification process could be time-intensive, depending on data complexity and the company's structure.

Adopting a one-size-fits-all approach to data masking tools isn't feasible for larger organizations due to the varied nature of data. The selection of masking techniques should be influenced by adherence to internal security standards, budget limitations, and may even involve developing bespoke masking solutions. Consistency in the use of these techniques is vital to ensure referential integrity across similar data types.

Protecting the methods and tools used for data masking is as critical as safeguarding the data itself. For example, the risk associated with a substitution method that uses a lookup file is significant if unauthorized parties access it. Implement strict access controls to safeguard the masking algorithms.

Transform data masking into a scalable, efficient, and automated routine. This adaptability prevents the need for redevelopment with every organizational, project, or product data alteration.

In conclusion, a robust data masking initiative should be holistic, including the identification of sensitive data, selecting and applying the correct masking techniques, and conducting ongoing audits to ensure the effectiveness of the masking efforts.

\section{conclusion}

In this section we explain in details what was data masking and the difference between dynamic and static masking.
We evaluated also the different masking methods including shuffling,substitution and scrambling etc.
Finally we showed masking constraints and how the masking algorithms would be different one another depending on the constraints followed.
In the following chapter we are going to look into the different legal compliance laws around the globe and how it touches the subject of data security.