Configuring Policies for Masking Sensitive Data

Learn to configure Database Firewall policy for masking sensitive data.

Database Firewall obfuscates passwords, string literals, and numerical constants by default for all SQL statements before logging in to the Audit Vault Server. In addition, the rules can be set for masking selective SQL statements. Data masking prevents sensitive and confidential data, such as credit card numbers from appearing in the log files, reports, and alerts. If a logged statement matches the data masking policy, the policy automatically replaces all user data in that statement.

Database Firewall masks the data depending on the data type:

• Delimited strings are masked as “#”.

• Passwords are masked as XXX.

• String literals are masked as “#”. String literals can be user names.

• All numerical constants like float, hexadecimal, decimal, integer, and binary constants are masked as “0” (zero). Numerical constants can be user ID.

  Note: After the data is masked by Database Firewall, it cannot be unmasked.

To set rules for data masking:

1. If you selected to mask based on criteria, enter the details as follows:

   Columns:

   • Choose from the list.

   • Or enter a database column name from the list of options available. Data masking is applied on the statements containing these columns.

   • To remove one or more column names that are selected, select on the cross mark (“x”) next to them. Accordingly the SQL statements are masked.

   Procedures:

   • Enter a procedure name and select from the list of options available to add the procedure name to the Procedures list. Data masking is applied on statements containing the specified procedures.

   • To remove one or more procedure names that are selected, select on the cross mark (“x”) next to them. Accordingly the SQL statements are masked.

2. Log in to the Oracle Database Security Central console as an auditor.

3. Select Policies

4. From the left navigation menu, select Database Firewall Policies.

5. Select the name of a specific policy.

6. Select Configuration.

7. Select Sensitive Data Masking

8. Select or deselect the Mask logged data checkbox.

9. Select one of the following options:

   1. For all statements: This is the default selection.

   2. For all statements matching the following criteria: If you select to mask based on criteria, then enter the details as follows:

   Columns:

   • Use the search dialog, choose from the list, and select Add to add to the list. Data masking is applied on the SQL statements listed in these columns.

   • To remove one or more column names, select them and select Remove. Accordingly the SQL statements are masked.

   Procedures:

   • If it is left empty, data masking is applied on SQL statements containing any procedure.

   • Use the search dialog, choose from the list, and select Add to add to the list. Data masking is applied on the SQL statements listed in these columns.

   • To remove one or more procedure names, select them and select Remove. Accordingly the SQL statements are masked.

10. Select Save.