SAP HANA's Dynamic Data Masking: The Smarter Way

-

 SAP HANA - a high-performance in-memory database - accelerates data-driven, real-time decision-making and practice. It supports all workloads with the most extensive advanced analytics on multi-model data, both on-premise and in the cloud.

SAP HANA offers a robust security system to help safeguard your data. Apart from the authentication/single sign-on, user/role and authorization management, audit logging, and encryption functionality that already existed, SAP HANA also offers native dynamic data masking functionality.

Authorization is the primary means of controlling access. The privilege framework of SAP HANA is based on standard SQL privileges allowing for fine-granular control, with extensions for different use cases such as dashboards or reporting. Roles allow for efficient separation of duties.



The functionality of native data masking alters how data appears in views without modifying the underlying data. Since the underlying data remains unchanged, calculations on the masked data can still be carried out by the database. This introduces an additional access control layer that can be added to views in order to secure sensitive or confidential data from power users having broad view access. For example, if you need to secure a column that displays employee social security numbers from users that might have SELECT rights on a view or schema but should not be able to access sensitive data, you can apply dynamic data masking.

Imagine you've got a view called "Employee Information" and you've got two users having access to this view that includes the fields: Surname, First Name, and SSN. Both of them have SELECT rights on the "Employee Information" view; this being a requirement for accessing the data regardless of whether the data is masked. The SSN field is masked so that the plain text data can only be accessed by the user with unmasked read access.

How to Configure Masking?

Within your SAP HANA program, if you want to use dynamic data masking, the configuration takes place directly in the view specification. The masked expression you are using is up to you; you can choose a static value or utilize an embedded function or stored procedure of your choice. You should not, however, modify the data type and original data length.

If the data is masked, the UNMASKED right can be granted initially only by the owner of a given schema or view. When a view is dependent on another view, the dependent-view owner's rights are always taken into account - definer mode applies.

The SAP HANA security guide contains extensive documentation on the configuration of the new data masking feature. Here you'll find some fantastic examples of how to configure the different types of masking.

In addition to configuring masking directly through SQL commands as defined in the SAP HANA Security Guide, SAP also provides tooling support for configuring masking through the SAP HANA WebIDE.

Configuring Data Masking in the SAP HANA WebIDE

Putting it briefly, after you have selected the column you want to mask, the data masking expression can be specified for the column you have selected. You have the choice of defining a simple static masking function or invoking built-in functions. All users who need to access the plain text data would need to be assigned the object privilege UNMASKED.

Comments

Post a Comment

Popular posts from this blog

The Most Prominent Emerging Cybersecurity Threats

-
Image
  Because of the   COVID-19 pandemic , organizations around the globe were forced to implement a work-from-anywhere scheme. With staff accessing cloud resources, collaborative tools, and remote systems from home and public networks, and not only via the privacy of a VPN, this has become the new way of doing business. This rapid transition brings a host of safety issues for businesses. Some of the most prominent cybersecurity threats are outlined here. 1. Evolving Traditional Cybersecurity Threats  Cyber threats such as phishing, malware, trojans, and botnets will remain prominent; it seems obvious. Such attacks, mostly mined from company websites and social networks, are increasingly automated and customized to personal information. These kinds of hazards will continue to increase in number and frequency as movements towards automation increase. These risks may be influenced by current events as well. During the pandemic, we saw a surge in phishing emails, taking advantage of the unfam
Read more

PeopleSoft SSO: Improving Employee Experience

-
Image
Employees manage various logins, including emails, financials, CRM software, and other programs and systems built during a regular workday to simplify their daily activities. Remembering and recalling all the usernames and passwords associated with such systems can be daunting and contribute to a loss of productivity. Single Sign-On (SSO) is an Identity and Access Management (IAM) method that enables users to authenticate securely with different websites and applications, by signing in only once — with only one set of credentials. The app or website (which the user is attempting to access) relies on a trusted third party with a Single Sign-On solution to authenticate the users' identity. Why is SSO important today for Human Resource Organizations? 1. SSO Makes the HR System User-Friendly and Easy to Use SSO's greatest benefit is that users can switch between applications safely without having to specify their credentials time and again. SSO effectively incorporates individual s
Read more

Improve Security Posture With The Zero-Trust Security Model

-
Image
  There has been a sea change in how employees connect to and interact with the enterprise resources to get things done. The conventional network security model was programmed to connect staff to the data center's services they required. There were very few remote workers at the time and using an operationally complex VPN, they linked back to their home network. With the dramatic, unpredictable changes brought about by the pandemic, most workers now work remotely, and almost all businesses today use multiple public cloud services. Coupled with the security flaws associated with VPNs, these factors mean that the conventional model is no longer reliable. The Zero-Trust Security Model A critical weakness in the usage of remote access VPNs is that once users are authenticated, they are considered trustworthy and given complete access. As a consequence, once a hacker reaches the firewalls of an organization, with little resistance, if any, he/she can travel around the network. John Kind
Read more