How to do data masking in Oracle in 2019

Oracle databases are among the best on the market. Users appreciate their various features, including new ones that the company regularly introduces. Backward compatibility, reliable storage and access to huge amounts of data, data recovery and durability are just some of the reasons why Oracle is a market leader.

It’s no surprise, then, that many banks, insurance companies and other large financial institutions use Oracle’s databases. Because such institutions constantly face new challenges, they often have to use their databases for additional business activities. Data masking is one activity that an increasing number of companies are having to deal with. There are many reasons why a company may need to do data masking in Oracle databases: to comply with data protection regulations (GDPR in the EU, HIPAA in the US), to prevent data breaches or simply to position itself as an organization that takes privacy seriously.

So what should you do if your organization needs to do data masking in Oracle databases? The first step is to decide whether you want to do the masking in-house using a script or choose a tool that will do the job for you (read more about different data masking techniques.) Our experience shows that using a tool is a more resource- and time-efficient option.

Let’s assume that you choose to go with a tool. Every database – including an Oracle database – works according to a certain framework that allows you to prepare the database for the masking process. The first issue that you might run into is that the existing framework is not good enough – that is, if your Oracle database has more than 100 million records (which can be quite common), the masking process will take too much time, which could disrupt your everyday activities.

Many BizDataX clients use Oracle databases, which means that good performance times are possible only if we create a highly optimized framework for their databases. For instance, during their recent work with a client whose Entity framework was performing poorly, our team of developers wrote a module using C#, which allowed them to speed-up the whole masking process.

The most common things that BizDataX clients need are data consistency (eg. John Smith is masked into Joe Wayne in all the tables in a database) and masking speed. Most importantly, though, none of them wants to disturb their current business practices. If, for example, they have a testing process in place where testers expect to receive a masked database at a certain point in time, they prefer to keep the process as it is. In short, performance matters, and it needs to work in a specific business environment.

Oracle supports bulk statements, which, in short, means that the performance of a database can be much faster than a simple insert. When you connect BizDataX to Oracle, the main benefits are BizDataX’s flexibility, customization and adaptability to clients’ environments. There’s no doubt that every client is different and that every project requires at least some modifications. If you use a script, this can make things very challenging; but if you use a dedicated tool, most of the time you don’t need third-party plug-ins, as is the case with scripts. For instance, BizDataX has full control over the masking process and the corresponding set of functionalities. If a client needs to mask only certain records in a table, BizDataX can do this easily.

An important thing to mention about Oracle or any other database is that masking performance depends on the hardware that you use for the job. Most of our clients provide us with databases that are on servers that are responsible for dozens of other operations. This can slow down the implementation of data masking. The rule of thumb should always be: more RAM, CPU cores and dedicated servers mean better performance for other operations but less time for data masking.

To get an idea of how data masking looks in practice, take a look at the figures below. They come from real case studies, including a client who used Oracle databases. Of course, such numbers can vary depending on the hardware that’s used and other factors, but they’re the average figures that are reached whenever BizDataX works with Oracle.

As you can see, speeds can vary from database to database. This mainly depends on the hardware configuration that is available for a project and server capabilities, as well as how well a bulk insert is performing. Some data masking providers claim they can mask millions of records per second. This may be true in theory, but the reality is that most organizations aren’t able to purchase expensive hardware solely for their data masking projects.

Finally, although Oracle offers a data masking tool for its databases, our clients often report that the tool has certain limitations that don’t fulfill their requirements. BizDataX stands out from the others – it’s very flexible and can adapt to any kind of environment, as well as any kind of database. The logic inherent in our product not only enables it to adapt to typical business processes but also allows it to add extension points for various scenarios.

To find out more about the possbilities of data masking in Oracle, book an appointment and talk to us directly.