
The field of data masking tools is broad, encompassing varied solutions that service its many requirements: from ensuring compliance with regulations such as GDPR and HIPAA to fostering a secure environment for software testing.
This chapter will take us through the key features in an attempt to understand what to look out for and choose the right tool that will meet your needs.


\section{Features to Look For in a Data Masking Tool}
As data masking can be used for different purposes, it is difficult to have a unique general tool that satisfies all the requirements.
When evaluating data masking tools, several key features and capabilities should be considered to ensure they meet your security and usability requirements \cite{datamaskingtoolsFeatures}:

\begin{itemize}
    \item \textbf{Data format}: Various masking tools are equipped to manage distinct data sources and formats, including relational databases, flat files, XML and JSON files, as well as data stored in cloud services. Additionally, certain tools are capable of masking data dynamically as it moves through streams, web services, or APIs. It's crucial to select a tool that can effectively mask your specific data types and sources, ensuring that the data's quality and integrity remain intact.
    \item \textbf{Masking techniques used}: Different data masking solutions employ a variety of methods and capabilities for concealing your data. These methods include, but are not limited to, encryption, hashing, substitution, scrambling, shuffling, and blurring. Moreover, certain solutions are engineered to preserve the data's referential, functional, or statistical integrity. It is crucial to select a solution that provides the necessary masking techniques and attributes that meet your specific requirements for data analysis. 
    \item \textbf{Performance and scalability}: The performance and scalability of your data analysis can be affected differently by various masking tools. For instance, certain tools offer the capability to mask data in real-time, upon request, or through batch processing. Additionally, some tools are designed to operate in parallel, distributed, or cloud-based settings efficiently.  It's essential to choose a tool that can mask your data with minimal impact on speed or interruption to your data analysis workflow.
    \item \textbf{Ease of use and ability to customize}: It varies significantly among data masking tools, impacting their suitability for your data analysis projects. For instance, certain tools may offer intuitive interfaces, templates, or guided wizards that simplify the setup and execution of data masking tasks. On the other hand, some tools provide more sophisticated features, such as customizable scripts or APIs, enabling you to tailor and automate masking processes. It's important to select a tool that aligns with your technical expertise and project requirements, ensuring it complements your workflow and skill set effectively.
    \item \textbf{Security and Compliance features}: The security and compliance capabilities of data masking tools can significantly differ, impacting their effectiveness in meeting your data protection objectives. For instance, various tools might incorporate features like encryption, authentication, authorization, along with auditing and logging to enhance the security and traceability of your masked data. Moreover, some tools are designed with compliance in mind, offering built-in rules, policies, or benchmarks to assist in conforming to specific regulatory or sector-based data protection standards. Identifying a tool that robustly defends your masked data against unauthorized use or access is essential for ensuring data safety and regulatory compliance.
    \item \textbf{Price}: The pricing and support offerings of data masking tools vary, affecting their alignment with your budgetary constraints and technical requirements for data analysis. Tools may range from being free and open-source to licensed with diverse pricing strategies, including per-user, per-project, based on the volume of data, or specific features. Additionally, support services differ among tools, encompassing a spectrum from comprehensive documentation and tutorials to online forums and dedicated customer support. It is crucial to select a tool that not only fits within your financial parameters but also provides the necessary technical support to achieve your data analysis objectives.
\end{itemize}

Selecting an appropriate data masking tool requires a detailed evaluation of these characteristics, taking into account your unique requirements for data security, the regulatory landscape, and your operational framework.

\section{Different masking tools on the market}


Different data masking tools are available on the market as it is a booming market and they meet different needs.
Here we are going to look into some of the most relevant masking tools on the market as of this year.
%When getting a data masking tool, emphasize the following must-have features: 

%International standard-based tools that automatically mask data according to conventions like HIPAA, CCPA, GDPR, etc.
%The tool should automatically seek out personally identifiable and sensitive data from a data set and apply a pre-configured data masking strategy.
%A perfect data masking tool should allow you to connect various data sources like open datasets and premium sources.
%There should be tough ciphering algorithms so that no one can reverse engineer the masked data to its original values except for the tool used for data masking.
%It should offer business-specific test data, fictitious but realistic data, etc., instead of original column headers, row headers, values, etc. Thus, the end product will be good for research and development purposes.
%Masked data should not be useful to competitors or hackers.  

\subsection{Delphix}

The Delphix Dynamic Data Platform\footnote{\url{https://www.delphix.com/solutions/data-compliance-security}} offers an automated solution for securing non-production environments by substituting sensitive details such as social security numbers, patient records, and credit card information with realistic, yet fictional data.

Contrary to encryption methods, which can be circumvented by acquiring user credentials, masking ensures irreversible data protection in downstream environments.
Delphix's ability to uniformly mask data while preserving referential integrity across diverse data sources gives it an edge over competing solutions, all without necessitating any programming skills.
Additionally, the Delphix platform integrates data masking with data delivery features, safeguarding sensitive information prior to its use in development and testing, or before being transferred to offsite data centers or the cloud.

As a web-based application accessible to multiple users, Delphix Masking delivers a comprehensive, secure, and scalable solution for discovering and  masking sensitive data, thereby satisfying the demands of enterprise-grade infrastructure \cite{delphixWhitePaper}.


Delphix has several key features and characteristics that enables it to mask sensitive data in a company.

\begin{itemize}
\item \textbf{End-to-End Masking}: The Delphix platform automatically identifies sensitive information, applies irreversible data masking, and then produces reports and sends email alerts to verify that all confidential data has been securely masked.

\item \textbf{Realistic Data}: Data masked using the Delphix platform maintains a production-level quality. 
Even in non-production settings, the application data that has been masked retains its full functionality and realism, facilitating the creation of superior-quality code.


\item \textbf{Referential Integrity}: Delphix ensures uniform masking across diverse data sources by scanning both metadata and data to recognize and maintain the primary/foreign key relationships among elements. This approach guarantees consistent data masking across various tables and databases.

\item \textbf{Algorithms/Frameworks}: Delphix framework comes equipped with more than twenty-five ready-made algorithms designed for masking a wide range of data types, from personal identifiers like names and addresses to sensitive information such as credit card numbers and textual content.
Additionally, Delphix includes predefined profiling sets tailored for managing healthcare and financial data.

\item \textbf{Ease of Use}: Delphix offers a unified solution that enables its customers to mask data across multiple platforms effortlessly. The platform's web-based interface allows for easy data masking through a simple series of mouse clicks, requiring minimal training for users.

\item \textbf{Automated discovery of sensitive data:} The Delphix Profiler simplify the process by automatically detecting sensitive information within databases and files, significantly cutting down the labor-intensive tasks typically associated with a data masking project.
\end{itemize}


\subsubsection{Delphix platform architecture}

The Delphix Dynamic Data Platform comprises four key services, each crucial in providing updated, secure data to all who require it. These includes:
\begin{itemize}
    \item \textbf{Virtualize}
    \item \textbf{Identify and Secure}
    \item \textbf{Manage} 
    \item \textbf{Self Service}
\end{itemize}

The image below explains the architecture workflow of this product \cite{delphixWhitePaper}.


\begin{figure}[!ht]% per piazzare la tabella t:top b:bottom h:here, in ordine di preferenza; h è sconsigliato
\centerline{\includegraphics[width=1\textwidth]{delphix_arch.png}}
\caption{Delphix architecture (source: \href{https://maskingdocs.delphix.com/}{MaskingDocs}).\label{fig:delphixArch}}
\end{figure}
\noindent
\textbf{Virualize} 

\noindent Delphix efficiently compresses collected data, typically reducing it to a third or even less of its original volume.
Leveraging this minimized data footprint, Delphix then virtualizes the data, enabling the creation of streamlined, virtual copies.
These copies are entirely independent and support full read/write capabilities. They can be rapidly deployed or decommissioned within minutes.
Remarkably, they occupy only a small fraction of the storage required for traditional physical copies, with the capacity to accommodate ten virtual copies within the storage space that would normally be occupied by a single physical copy

\noindent\textbf{Identify and Secure} 

\noindent The Delphix platform consistently safeguards private data through its built-in data masking feature.
It protects sensitive information, such as names, email addresses, patient records, and social security numbers, by substituting these details with fictitious but plausible alternatives. Delphix is designed to automatically detect sensitive information and then enforce either custom or pre-established masking algorithms. By merging data masking with the data provisioning process within one unified platform, Delphix guarantees a streamlined and reproducible approach to delivering data securely.

\noindent\textbf{Manage} 

\noindent Data operators are now able to swiftly provide users with secure copies of data in their designated environments, completing the process in just minutes.
The Delphix platform acts as a centralized control hub for managing these copies.
It gives data operators complete oversight and control over downstream environments, allowing them to efficiently conduct audits, monitoring, and reporting on access and utilization.

\noindent\textbf{Self-service}

\noindent Gives various users, including developers, testers, analysts, data scientists, among others, the flexibility to adjust data as needed.
Users have the ability to update data to mirror the most recent production status, revert environments back to an earlier state, save data copies for future reference, create branches of data copies for simultaneous work on different versions, or conveniently distribute data among colleagues.


%Delphix is a data masking and compliance solution that can automatically locate sensitive information and mask those. Whether it is the customer name, email address, or credit card number, it can find 30 types of critical data from different sources, such as relational databases and files.

%The solution offers over 50 out-of-the-box profile sets defining custom profiling expressions. To run its masking algorithms, you do not need to know to code. It can retain referential integrity within and across the data sources while generating realistic values. Delphix also allows you to easily customize its algorithm frameworks; if needed, you can define new algorithms.

%Masked data quality is preserved in fully functional status so you can use it for development, testing, and analysis. Companies that need to comply with standards and regulations like GDPR, HIPAA, and CCPA can use this platform for data tokenization and irreversible masking. Moreover, it lets you define and apply consistent masking policies to eliminate the risks across non-production environments.




%Delphix Masking is a multi-user, browser-based web application that provides complete, secure, and scalable software for your sensitive data discovery, masking, and tokenization needs while meeting enterprise-class infrastructure requirements. The Delphix Dynamic Data Platform has several key characteristics to enable your organization to successfully protect sensitive data across the enterprise:
%
%textbf{%End-to-End Masking}% — The Delphix platform automatically detects confidential information %irreversibly masks data values, then generates reports and email notifications to confirm that all sensitive data has been masked.

%\textbf{Realistic Data} — Data masked with the Delphix platform is production-like in quality. Masked application data in non-production environments remain fully functional and realistic, enabling the development of higher-quality code.

%\textbf{Masking Integrated with Virtualization} — Most masking solutions fail due to the need for repeated, lengthy batch jobs for extracting and masking data and lack delivery capabilities for downstream environments. The Delphix Dynamic Data Platform seamlessly integrates data masking with data virtualization, allowing teams to quickly deliver masked, virtual data copies on premises or into private, public, and hybrid cloud environments.

%\textbf{Referential Integrity} — Delphix masks consistently across heterogeneous data sources. To do so, metadata and data is scanned to identify and preserve the primary/foreign key relationships between elements, so that data is masked the same way across different tables and databases.

%\textbf{Algorithms/Frameworks} — Seven algorithm frameworks allow users to create and configure algorithms to match specific security policies. Over twenty-five out-of-the-box, preconfigured algorithms help businesses mask everything from names and addresses to credit card numbers and text fields. Moreover, the Delphix platform includes prepackaged profiling sets for healthcare and financial information, as well as the ability to perform tokenization: a process that can be used to obfuscate data sent for processing, then reversed when the processed data set is returned.

%\textbf{Ease of Use — With a single solution}, Delphix customers can mask data across a variety of platforms. Moreover, businesses are not required to program their own masking algorithms or rely on extensive administrator involvement. Our web-based UI enables masking with a few mouse clicks and little training.

%\textbf{Automated discovery of sensitive data} — The Delphix Profiler automatically identifies sensitive data across databases and files, the time-consuming work associated with a data masking project is reduced significantly.

%\textbf{High-Level Platform Architecture}
%Delphix strives to make available multiple methods for securing your data, depending on your needs. The two secure methods Delphix currently supports are masking (anonymization) and tokenization (pseudonymization).

%Masking

%Data masking secures your data by replacing values with realistic yet fictitious data. Seven out-of-the-box algorithm frameworks help businesses mask everything from names and social security numbers to images and text fields. Algorithms can also be configured or customized to match specific security policies.



%Tokenization

%Tokenization uses reversible algorithms so that the data can be returned to its original state. Tokenization is a form of encryption where the actual data – such as names and addresses – are converted into tokens that do not convey any meaning (with regards to appearance and formatting).



\subsection{K2View}


K2View\footnote{\url{https://www.k2view.com/solutions/data-masking-tools/}} is an ideal choice for safeguarding a substantial amount of sensitive data.
This tool adopts a data product methodology that simplifies the implementation process and cuts down on both time and expenses, all while addressing complexities found in enterprise environments.

It leverages automatic discovery and data cataloging capabilities to identify, classify, and organize sensitive information. 
Additionally, K2View enables detailed searches at the level of database files and metadata.
The tool offers the flexibility to use numerous pre-configured masking functions, including but not limited to, substitution, randomization, shuffling, scrambling, data type conversion, clearing data, and concealing parts of the data, ensuring comprehensive data protection \cite{greekflare}.

%In addition, it supports integration with data sources or technology, whether they are located on-premise or in the cloud. You can connect this solution to relational databases, legacy systems, NoSQL, XML docs, message queues, and flat files to mask data with referential integrity.

\subsubsection{Architecture overview}

The K2View Data Masking Solution is structured around two primary components \cite{k2ViewWhitePaper}:

\begin{itemize}
    \item The LUDB CONFIGURATION
    \item  The EXECUTION SERVER(S)

\end{itemize}

The LUDB Configuration is a detailed, version-controlled setup encompassing all aspects necessary for the data masking implementation, including:
\begin{itemize}
    \item Parameters for connecting to source and destination systems
    \item Definitions of masking rules (further elaborated in the DATA MASKING FEATURES section)
    \item Rules for Extract, Transform, and Load (ETL) processes, which may cover data enhancement, validation, reporting, or checks for data integrity. 
    For an in-depth understanding of K2View's ETL capabilities, refer to our Data Migration documentation.

\end{itemize}


The execution server(s) consist of a network of servers that are managed through the LU Studio.
This setup is responsible for extracting, masking, transforming, and transferring data from its source to the designated target. 
Each server runs several threads of the ETL + MASKING ENGINE, facilitating the distributed execution of data masking tasks, which results in exceptionally high performance.

\begin{figure}[!h]% per piazzare la tabella t:top b:bottom h:here, in ordine di preferenza; h è sconsigliato
\centerline{\includegraphics[width=1\textwidth]{data_Architecture_k2View.jpg.png}}
\caption{k2View architecture (source: \href{https://docplayer.net/19482698-Data-masking-a-white-paper-by-k2view-abstract-k2view-data-masking.html/}{MaskingDocs}).\label{fig:k2ViewArch}}
\end{figure}

\subsubsection{K2View Data masking features}

\begin{itemize}
    \item \textbf{End to End masking}: The Delphix platform seamlessly identifies sensitive information, applies irreversible masking to the data, and subsequently produces reports and sends out email alerts to verify the complete masking of all confidential data.

    \item \textbf{Realistic data}: Data masked by the Delphix platform maintains a quality akin to that of production data. Even within non-production settings, the application data that has been masked continues to be entirely operable and realistic, facilitating the creation of code of superior quality.

    \item \textbf{Referential Integrity}: Delphix ensures uniform masking across diverse data sources by analyzing both metadata and data to recognize and maintain the relationships between primary and foreign keys among elements. This approach guarantees consistent data masking throughout various tables and databases.

    \item \textbf{Ease of Use}: Delphix offers a unified solution that enables its users to apply data masking across multiple platforms effortlessly. Additionally, it eliminates the need for companies to develop custom masking algorithms or depend heavily on administrative support. The platform's web-based interface facilitates easy data masking with just a few clicks, requiring minimal training.

    \item \textbf{Automated discovery of sensitive data}: The Delphix Profiler streamlines the process by automatically detecting sensitive information within databases and files, considerably cutting down the labor-intensive efforts typically required for a data masking project.
\end{itemize}





%\subsection{Accutive}
%Accutive offers a useful range of robust data masking tools that not only keep your critical data secure but also retain it viable for different business-critical functions. This on-premises solution ensures that masked information looks like real information by retaining the made-up values of data fields and properties across all data sources.

%It supports data migration from sources including Oracle, DB2, SQLServer, XML, MySQL, and flat files to selected destinations. You can also store the masked data in MySQL, SQLServer, PostgreSQL, and other databases. This cross-platform software can be used in Linux, Unix, Windows, and different cloud services.

%Accutive also offers a highly-functional dashboard to see the latest activity, active connections, graphic data masking results, and task progress. Detailed reporting, performance insights, integrated account management, login directory, and multi-factor authentication compatibility are some other mentionable features of this solution.

\subsection{Informatica}

Informatica's\footnote{\url{https://www.informatica.com/it/products/data-security/data-masking/dynamic-data-masking.html}}  Dynamic Data Masking masks or restricts access to sensitive data depending on a user's role, geographic location, and permissions. 
It can notify administrators of attempts to access this data without authorization and maintains records for compliance and auditing purposes \cite{informaticaWhitePaper}.

\subsubsection{Informatica's Key benefits}

\begin{itemize}
    \item \textbf{Policy-Driven, Role-Based, Real-Time Data Protection}: Informatica Dynamic Data Masking implements real-time data privacy and security measures by dynamically masking, concealing, blocking, auditing, and alerting on unauthorized access.
    It offers customizable restrictions on access at various levels, including screens, tables, columns, rows, and individual cells.
    

     \item \textbf{Scalable and Easy to Install and Configure}:
     The software is capable of scaling up to support hundreds of databases through a single installation, facilitating rapid and uniform restriction of access across various tools, applications, and environments. 
     This is achieved by establishing data masking policies just once and then applying them repeatedly. Moreover, these data-masking algorithms can be applied to sensitive data in any format.

    \item \textbf{Versatile and Nonintrusive to Applications or Databases}:
    Dynamic Data Masking is compatible with a variety of environments, including virtualized, traditional, big data, and cloud computing setups.
    It safeguards against unauthorized access to both custom and packaged applications, data warehouses, and operational data stores, all without affecting performance.
    Importantly, using Dynamic Data Masking does not necessitate modifications to existing applications or databases.

    \item \textbf{Integration With Authentication Software: } Informatica Dynamic Data Masking restricts access to sensitive business information, ensuring that only individuals who fulfill selected security criteria can view it. Additionally, the software integrates with your current identity management systems to hasten deployment and enhance the security coverage of your applications and tools.

    \item \textbf{Real-Time Data Masking and Blocking :} The software preserves the original data untouched and ensures that the functional look and consistency of the masked data remain intact for complex applications.
    It achieves this by synchronizing data values across different rows and tables.
    
\end{itemize}

\subsubsection{Informatica's data masking Key Benefits}

\begin{itemize}
    \item \textbf{Cost-Effectively Protect Personal and Sensitive Data: } Informatica Dynamic Data Masking offers an economical solution for safeguarding your data against both internal and external threats of data breaches, without affecting the application's performance.
    It is straightforward to set up and instantly anonymizes sensitive data in real time. 

    \item \textbf{Quickly Customize Privacy and Security Solutions for Maximum ROI: }Swift and simple to deploy across a variety of systems, including applications, backups, clones, data warehouses, as well as tools for development and database administration.

    \item \textbf{Support Digital Transformation, Privacy, and Cloud: } By ensuring secure entry to both production and non-production environments, your IT department can enhance efficiency and swiftly adapt to business demands.
    This support accelerates digital transformation, privacy projects, and the transition to big data and cloud-based assets.
\end{itemize}
    



%With Informatica cloud data masking, you can easily safeguard your client data privacy. It assists you in meeting organizational compliance objectives of safe data handling and data security governance. You can use it to anonymize and de-identify sensitive data for safely using the data for testing, development, data analytics, supply chains, and customer experience programs.

%This platform lets you have flexible, data-centric security across all complex environments your organization uses. You can use this solution to protect data in cloud-native privacy and data governance. While doing all these, Informatica maintains data context and referential integrity for heightened security and compliance-proof use.

%It masks all the personal data, including users, locations, birthdates, and roles, from a large volume of data from different locations and databases. The solution supports broad connectivity across databases, applications, and mainframes. It also reduces the risk of data loss or data misuse. 


%\subsection{Hush-Hush}

%For modern-day businesses, it is challenging to comply with public and regulatory privacy requirements. However, you have a Hush-Hush solution to help you with PII data masking. You can use this software to locate sensitive data from your organizational database and classify those for anonymization. 

 %During data masking, it complies with GDPR, HIPAA / HITECH, CCPA, and GLBA standards. Hush-Hush even uses rule-based components for comprehensive configuration and secure data anonymization. It also provides out-of-the-box solutions to mask direct and indirect identifiers using fixed and generic algorithms. 

%Moreover, the solution can run on-premise and in the cloud. You can also integrate it with native SQL server SSIS, Biztalk, and code using API. With this solution, you can perform data anonymization jobs on a schedule or an ad-hoc basis. It also builds audit trail reports for different regulatory compliances like GDPR, CCPA, and HITECH.



%\subsection{dataZense}


%Do you want to keep your data secure and compliant? Choose dataZense, the data masking solution for sensitive data protection. The tools provided by this platform help you with data profiling, data loss prevention, remediation, and data governance. It can profile structured and unstructured data, so you do not have to worry about the data sources.

%The solution performs column-level data profiling to effortlessly identify PII and sensitive data from the database. There is also the Business Validation Process that assists with reviewing and approving data as sensitive. dataZense also prevents unauthorized data access or misuse with data masking, scrambling, or encryption.

%This cloud-based platform can be accessed from anywhere at your convenient time. It also supports GDPR, CCPA, OIOO, and other privacy laws and standards. This scalable platform ensures continued protection but allows you to pay only for masked data.

%With dataZense PII data discovery tools, organizations can protect sensitive information and comply with regulations. 


%\subsection{DataVeil}

%DataVeil offers two powerful data masking tools named DataVeil and FileMasker. The first tool masks sensitive data in different SQL databases, while the latter permanently masks data from files. These tools mask all the sensitive data like names, addresses, contact numbers, and credit card numbers with fictitious information that will sound real. 

%Since masking transforms the data into something non-sensitive, organizations can use that for testing, development, training, outsourcing, data analysis, and support. Since data security and privacy laws worldwide are becoming more rigorous, you can use this solution to comply with GDPR, HIPAA, and PCI. 

%While masking, it maintains the statistical and syntactical properties of originally sourced data by providing meaningful and relevant masked data. It even preserves the format of individual characters present in a sensitive value, such as alphabet, number, and special character. Thus, you can use the data without worrying about testing, development, data analysis, training, support, and outsourcing


\subsection{Immuta}

The Immuta Data Security Platform\footnote{\url{https://www.immuta.com/product/}} helps organizations secure their data by providing sensitive data discovery, security and access control, and activity monitoring \cite{ImmutaIntro}.

\subsubsection{Immuta's features}

\begin{itemize}
    \item Sensitive data discovery
    \item Security and access control
    \item Continuous monitoring
\end{itemize}

\noindent\textbf{Sensitive data discovery}

\noindent Immuta automatically identifies and categorizes sensitive information, such as PII and PHI, within data lakes and warehouses, aligning with regulations like GDPR, HIPAA, PCI, among others.
This process provides complete insight into which data needs access restrictions and ongoing surveillance \cite{MetaDataInImmuta}.

\noindent\textbf{Security and acccess control}

\noindent The Immuta security and access management solutions for data assist data-centric organizations in minimizing their operations, facilitating increased protection, and at the same time allowing the utilization of their value contained in the data without experiencing delays.
In addition, the use of dynamic data security may reduce policy management to the complexity of obtaining appropriate data to the right persons in due time.
This makes it much easier and more efficient for data collaboration across business units, geographic locations, and with external parties.
This includes the ability to rapidly develop and deploy data products that impact the bottom line in a positive way \cite{SecureAccessImmuta}. 

\noindent\textbf{Continuous Monitoring}

Immuta delivers quick awareness to risky user behaviour regarding user data access and that facilitates data security posture management. Continuous monitoring and detection capabilities enables you to continuously track the usage of sensitive data and identify the user involved and at the same time uncover the vulnerabilities withing your data environment \cite{DetectImmuta}.

\subsubsection{Immuta's data masking}

Immuta's dynamic data masking offers a solution for organizations in various sectors to streamline their processes, enhance data protection, and realize the value of sensitive data. 
Through the application of dynamic data masking, you have the ability to distribute data in adherence to laws, standards, and agreements on data sharing, lessen the technical workload through dynamic policy enforcement without the need to duplicate data \cite{DDMImmuta}.


Advantages of using Immuta data masking can be summarized as:
\begin{itemize}
    \item \textbf{Plain Language Policy Authoring}:
    Immuta enables the creation of attribute-based access control policies either in straightforward language or through coding, making them manageable for stakeholders of any level.
    This facilitates data masking without requiring specialized technical expertise.

    \item \textbf{Dynamic data masking}:
    Manually duplicating data and then redacting or anonymizing it can slow down analysis and diminish the usefulness of the data.
    Immuta's dynamic data masking policies offer techniques such as hashing, regular expression, rounding, conditional masking, and substitution with null values or constants, including options for reversible and format-preserving masking, as well as external masking. 
    This is achieved without the need to copy or relocate data.

    \item \textbf{Condition data masking}:
    Guard against data breaches without depending on manual modifications.
    Immuta automates the implementation of access limits using masking policies that are contingent on specific conditions, including time periods, the geographical locations of users, and data found in neighboring cells or linked tables.
    Through the use of conditional logic in its masking policies, Immuta provides adaptable policy application while minimizing exposure to risk.
    
\end{itemize}

%When it comes to dynamic data masking and privacy controls, Immuta could be your ideal choice. During query time, it hides sensitive values through modification without changing the original data. In its security and privacy control suite, you can instruct an attribute-based access control policy. For policy language, you can either choose to write in code or plain language.

%It also offers more than 60 pre-built security and privacy controls from which you can select any to protect sensitive data. You can also dynamically apply these controls at query time for different types of data masking, including anonymization, pseudonymization, minimization, and obfuscation. 

%These dynamic policies allow you to instantly access the authorized data from any notebook, BI tool, or workbench. On Immuta, you can automate the process of access restrictions with different conditions, like user demography, time-based windows, adjacent cell data, or reference table data. 

%Above all, it reduces the engineering burden and lets you access the masked data instantly.  This software also reduces the risk of data breaches, protects your organizational reputation, lets you share data securely, and increases your team’s productivity.



\subsection{Apache Ranger}

Apache Ranger\footnote{\url{https://ranger.apache.org/}} is a free, open-source security framework designed to enhance security on big data platforms, including Hadoop.
It acts as a security guard for your data, managing and enforcing comprehensive access controls and security policies across the data ecosystem.
Apache Ranger offers a centralized system for managing security policies, including user and group access controls, authorization protocols, and audit regulations.
Its integration with prevailing big data platforms allows for the consistent application of these security measures throughout the entire big data infrastructure \cite{apacheRanger}.

\subsubsection{How Ranger works}

Apache Ranger operates through a central administration interface, allowing the creation, modification, and implementation of security policies.
These policies can be tailored based on several factors, such as the identity of the user, IP address, the time of access, and the sensitivity of the data involved \cite{apacheRangerMaskingAndFiltering}.

\subsubsection{The most important Apache Ranger use cases}

\begin{itemize}
    \item  \textbf{Role-based Access Control Enforcement(RBAC):} Apache Ranger facilitates the development and oversight of RBAC policies tailored for big data environments.

    \item \textbf{Data Masking: } Apache Ranger is capable of obscuring confidential information according to the user's level of authorization, thereby preventing access by unapproved personnel.

    \item \textbf{Data Encryption: }Apache Ranger offers policies for encrypting data, safeguarding it while stored and during transfer.

    \item \textbf{Activity Monitoring and Audit Trails:} Apache Ranger delivers comprehensive audit records, detailing user interactions and access to sensitive information.

\end{itemize}


\subsubsection{Row Level filtering and Column masking}

Apache Ranger policy model has been enhanced to support row-filtering and data-masking features. 

\noindent\textbf{Column Masking Overview}

\noindent Column-masking provides a secure and adaptable way to quickly conceal sensitive data in a Hive source.
Through security policies managed by Apache Ranger, you can dynamically mask or obscure personal information at the column level within Hive query results. 
By employing various masking techniques, it's possible to configure a column to show only the year from a date, or just the first or last four digits of a number, among other options. Column-masking is governed by several rules:
\begin{itemize}
    \item Masking can be assigned to individual users, specific groups, and under certain conditions.
    \item A unique masking policy is required for each column.
    \item The sequence in which masks are applied follows their arrangement in a query or within a security policy.
\end{itemize}

Ranger-based  column masking operate as a form of ``implicit view,'' substituting references to tables or views in an SQL query before the query is executed. This substitution is determined by analyzing user permissions. For instance, if a user has access to ``table1'' but is subject to a masking rule on ``table1.column'' that changes its content to 'xxx'. An example of this feature could be that this:

\begin{verbatim}
SELECT column_1, column_2, column_3
FROM table1
\end{verbatim}

would become this:

\begin{verbatim}
SELECT 'xxx' AS column_1, column_2, column_3
FROM table1
\end{verbatim}

\noindent \textbf{Row level filtering overview}

\noindent Row-level filtering simplifies queries and bolsters data security for user- or role-based query executions
By employing SQL functions or Apache Ranger security policies, access can be confined at the dataset level, influencing the execution of queries. 
Implementing row-level security on compatible tables serves to minimize the risk of sensitive data exposure to certain users or groups, thereby enhancing control over data access.

Row-level restrictions may be set by user, group/role, and other conditions.
This is a topic that will be very well studied in the other chapters of the thesis as it holds a very important role in the project developed.


An example would be:
\begin{verbatim}
SELECT column_1
FROM table_1
WHERE column_3
\end{verbatim}

This one would become:

\begin{verbatim}
WITH filtered_table_1
AS (
  SELECT column_1, column_2, column_3
  FROM table_1
  WHERE column_2 
)
SELECT column_1
FROM filtered_table_1
WHERE column_3;

\end{verbatim}

In this example above, the table has been filtered in the first place with the column\_2 before the second query of ours have the occasion to query it.





%Are you worried about managing your large volume of data at risk? IRI FieldShield is a reliable data masking solution for all kinds of organizations. Companies that use this software can perform central PII classification, locate data from any global location and mask the data automatically.

%It can also maintain referential integrity when it uses encryption, pseudonymization, redaction, and approaches for production and test environments. You can seamlessly anonymize the data under GDPR, CIPSEA, HIPAA, DPA, PCI, FERPA, GLBA, POPI, and other regulations. 

%IRI FieldShield supports masking data generated in every source, including relational databases, NoSQL databases, Flat Files, Mainframes, Excel spreadsheets, index files, URLs, semi-structured files, and unstructured files. Its features can be utilized for profiling and de-identifying data at rest and securing data in motion. If interested, you can book a live demo to see how it works.






