<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-masking
description: >-
  Implement static and dynamic data masking to protect sensitive data in
  non-production environments, analytics pipelines, and application views
  while preserving data utility for development, testing, and reporting.
domain: cybersecurity
subdomain: data-security
tags:
  - data-masking
  - tokenization
  - anonymization
  - pseudonymization
  - gdpr
  - test-data
  - privacy-by-design
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1005"]
---

# Implementing Data Masking

## Overview

Data masking replaces sensitive data with realistic but non-sensitive
substitutes. Static masking creates permanent copies for non-production use.
Dynamic masking applies transformations at query time based on user roles.
Effective masking preserves referential integrity and data utility while
eliminating exposure risk in development, testing, analytics, and support
environments.

Mode: `[MODE: PRIVACY]` — Data protection and privacy engineering.

## Prerequisites

- Data classification identifying columns/fields requiring masking
- Masking rules mapped to data types (names, SSNs, emails, etc.)
- Database access for static masking operations
- Application-layer integration for dynamic masking

## Key Concepts

### Masking Techniques

| Technique | Description | Reversible | Use Case |
|-----------|-------------|-----------|----------|
| Substitution | Replace with realistic fake data | No | Dev/test environments |
| Shuffling | Randomize values within column | No | Analytics, preserves distribution |
| Redaction | Remove or replace with fixed value | No | Logs, support tickets |
| Hashing | One-way hash of original value | No | Pseudonymization |
| Tokenization | Replace with token, vault stores original | Yes | Payment processing |
| Format-preserving encryption | Encrypt preserving format | Yes | Legacy system compatibility |
| Nulling | Replace with NULL | No | Remove unnecessary fields |

### Masking Rules

```python
MASKING_RULES = {
    "ssn": {"technique": "redaction", "pattern": "***-**-{last4}"},
    "email": {"technique": "substitution", "domain": "example.com"},
    "name": {"technique": "substitution", "source": "faker"},
    "credit_card": {"technique": "tokenization", "preserve_last4": True},
    "phone": {"technique": "redaction", "pattern": "(***) ***-{last4}"},
    "date_of_birth": {"technique": "generalization", "precision": "year"},
    "address": {"technique": "substitution", "source": "faker"},
    "salary": {"technique": "bucketing", "ranges": [50000, 100000, 150000]},
}
```

### Scanning CLI

```bash
# Apply static masking to a CSV file
node scripts/agent.js --action mask --input /data/users.csv \
  --rules ssn,email,name --output /tmp/masked_users.csv

# Validate masking quality
node scripts/agent.js --action validate --input /tmp/masked_users.csv \
  --original /data/users.csv --output /tmp/masking_report.json

# Generate masking configuration
node scripts/agent.js --action config --columns "ssn,email,name,phone" \
  --output /tmp/masking_config.json
```

## Workflow

### Step 1: Identify Sensitive Columns

Map all columns requiring masking based on data classification.

### Step 2: Apply Masking Rules

```bash
node scripts/agent.js --action mask --input /data/users.csv \
  --rules ssn,email,name --output /tmp/masked_users.csv
```

### Step 3: Validate Masking

```bash
node scripts/agent.js --action validate --input /tmp/masked_users.csv \
  --original /data/users.csv
```

### Step 4: Deploy to Non-Production

Replace sensitive data in dev/test/staging with masked copies.

## Detection

```yaml
title: Data Masking Detection
id: 91ca6679-b9bb-4012-b673-a322cbe1342e
status: experimental
description: Detects suspicious activity related to implementing data masking techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1005
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] All sensitive columns identified and masking rules assigned
- [ ] Static masking applied to non-production environments
- [ ] Dynamic masking configured for role-based access
- [ ] Referential integrity preserved across masked datasets
- [ ] Masking validation confirms no sensitive data leakage
- [ ] Tokenization vault secured with access controls
- [ ] Masking process automated in data refresh pipeline

## References

- [GDPR Article 25 — Data Protection by Design](https://gdpr-info.eu/art-25-gdpr/)
- [NIST SP 800-188 — De-Identifying Government Datasets](https://csrc.nist.gov/publications/detail/sp/800-188/final)
- [PCI DSS Requirement 3.4 — Render PAN Unreadable](https://www.pcisecuritystandards.org/)
- [OWASP — Data Masking Best Practices](https://owasp.org/www-project-data-security/)
