Skip to content

Get the most out of MSSQL !

Consultant & Trainer for all things MSSQL

  • Home
  • Company
  • Business Intelligence
  • Simply Better Business

SQL 2016 – Dynamic Data Mask –& Hacking the feature

Posted on September 15, 2015March 20, 2021 by jayanth.kurup

After working with PHI for many years now, I can appreciate the importance of data masking. While normally the first approach is to encrypt the data it is often too much security for the purpose of preventing unauthorized access. Often I have had to sign very complicated NDAs just to ensure that I don’t access unauthorized data even by mistake. Hopefully all that will change now that we have Dynamic data masking.

So how is dynamic data masking (DDM) different from encryption? Well the simple answer is in every way. Encryption uses a salt and encryption key to jumble the data both at the page level and in motion. Encryption uses additional resources in order to achieve this and therefore brings with it performance implications too. We can avoid these challenges by using dynamic data mask because it applies the mask once the data has been fetched from disk therefore there is no overhead at the disk and CPU level. In addition unlike encryption where we need all the values to be unique after encryption in DDM the concept if to hide the data under a common default value therefore preventing people from deriving meaning from the data.

So how do you enabled DDM?

You don't it's enabled by default, but you can disable it using the trace flag 

DBCC TRACEOFF (209, 219,−1) 

Since the masking happens at the columns level you need to keep in mind the data types being used. There are two ways you can mask the data, using the default values or choosing a custom format of your own.

Create TABLE [dbo].[DDM](
[id] [int] IDENTITY(1,1) masked with ( function='default()') NOT NULL,
[Name] [varchar](20) masked with ( function='default()'),
[Age] [int] masked with ( function='default()'),
[DOB] [date] masked with ( function='default()'),
[Createtime] [datetime2](7) masked with ( function='default()'),
[Email] [varchar](50) masked with ( function='email()'),
[CustomPhNum1] [varchar](20) masked with ( function='partial(1,"XX-XX-XXX",3)'),
[CustomPhNum2] [varchar](20) NULL
) ON [PRIMARY]

The above example shows how to create a table with a few columns that are masked more details on the feature can be found in the link under references. You will need to save the table create script since the generate scripts or other ways in SSMS will not script out these DDM syntax.

Also if you really want to hack the data you can simple put the output in a temp table and read from there even if the datatypes are the same temptables could be used anywhere in the code and as a result the data is not masked. Might be worthwhile to consider masking of the last select comes from a temptable.

Identity columns cannot be masked so if used for things like account number, order number etc then be careful.

References

https://msdn.microsoft.com/en-us/library/mt130841.aspx

Please Consider Subscribing

Subscribe

CategoriesDatabases, Performance TuningTagsaccess, account, addition, administration, age, AI, Analysis Services, answer, app, Applies, approach, ASP, aspx, author, AWS, Azure, Bangalore, Bengaluru, BigData, BLR, Business Intelligence, care, cause, challenge, change, CHAR, Cloud, code lang, column, concept, Consultant, Consulting, Corporate, count, CPU, CREATE, Create Table, Data, data type, database, datatypes, date, datetime, DBCC, dbo, DDM, default value, detail, development, disk, DOB, Dynamic data, email, en-US, Enabled Business Solutions, enabledbusiness, enabledbusinesssolutions, Encryption, event, example, expert, feature, flag, form, format, fun, function, head, Hope, identity, identity column, importance, index, India, int, Jayanth, key, Kurup, LAG, level, lib, library, lie, load, mail, Mary, mean, meaning, microsoft, Migration, min, mind, mistake, ML, ms sql server, MSBI, msdn, MSSQL, MYSQL, name, need, network, NULL, number, Oracle, order number, output, overhead, part, people, performance, performance implication, png, power pivot, Power Query, PowerApps, PowerBI, Powershell, pre, PRIMARY, purpose, Python, rate, RDBMS, reference, Remote, resource, result, script, sec, security, SELECT, show, shows, side, sign, Simple, simple answer, solution, source, sql, SQL 2000, SQL 2005, SQL 2008, sql 2008 r2, sql 2012, SQL 2014, SQL 2016, SQL 2017, SQl 2019, SSAS, SSIS, SSMS, SSRS, syntax, T-SQL, tab, Tables, temp table, thing, tools, trace, TRACE FLAG, trainer, Transact, tsql, tuning, type, unique, unl, Upgrade, uploads, Uri, value, VALUES, varchar, Very large database, Virtual, virtual machine, visual studio, VM, windows, work, worth, year

jayanth.kurup

This post was written by Jayanth Kurup. A Microsoft SQL Server Consultant and Trainer based out of Bangalore, India. Jayanth has been working on MS SQL Server for over 15 years. He is a performance tuning and Business Intelligence expert. Having worked with companies like Microsoft, DELL, Wells Fargo, Thomson Reuters and many other fortune 100 companies. Some other technologies Jayanth works on include Microsoft Azure, PowerBI, Python and AWS. When he isn’t consulting or training, Jayanth like to travel, paint and read. He is also very active in social causes and the founder of Enabled Business Solutions. Visit his company by clicking the link in the menu or email him directly.

Post navigation

PreviousPrevious post: SQL 2016 – Stretch database in detail –CTP 2.3 screenshots with BOL corrected now
NextNext post: Suspect MSDB and no Backups

The Latest

  • Monty Hall Simulation using T-SQL April 5, 2022
  • Query to quickly profile a column February 7, 2022
  • Outlook 2019 keeps asking for password multiple times December 9, 2021
  • Part 2:- Learning T SQL for beginners – Datatypes September 28, 2021
  • Part 1:- Learning T SQL for beginners- SQL, Tables and Nulls September 27, 2021
  • Query to find execution time of Jobs July 28, 2021
  • A simple script to decapitalize Column names July 19, 2021
  • My personal side effects with Covishield June 27, 2021
  • Setting up and Configuring CUDA, CUDNN and PYTorch for Python Machine Learning. June 3, 2021
  • keras.utils.generic_utils’ has no attribute ‘populate_dict_with_module_objects May 30, 2021

Find By Category

  • Azure
  • Databases
  • Events
  • Performance Tuning
  • PowerBI
  • Uncategorized
  • Website Design

Archive

  • April 2022 (1)
  • February 2022 (1)
  • December 2021 (1)
  • September 2021 (2)
  • July 2021 (2)
  • June 2021 (2)
  • May 2021 (2)
  • April 2021 (5)
  • March 2021 (10)
  • January 2021 (2)
  • November 2020 (2)
  • October 2020 (3)
  • September 2020 (4)
  • August 2020 (6)
  • July 2020 (1)
  • June 2020 (32)
  • May 2020 (18)
  • April 2020 (2)
  • March 2020 (4)
  • February 2020 (5)
  • January 2020 (1)
  • December 2019 (1)
  • November 2019 (14)
  • October 2019 (3)
  • September 2019 (1)
  • July 2019 (3)
  • June 2019 (2)
  • May 2019 (1)
  • April 2019 (2)
  • March 2019 (1)
  • January 2019 (4)
  • December 2018 (2)
  • November 2018 (4)
  • September 2018 (6)
  • August 2018 (2)
  • July 2018 (3)
  • June 2018 (4)
  • May 2018 (1)
  • April 2018 (4)
  • March 2018 (3)
  • February 2018 (3)
  • January 2018 (1)
  • December 2017 (2)
  • November 2017 (4)
  • August 2017 (2)
  • July 2017 (5)
  • May 2017 (1)
  • March 2017 (3)
  • January 2017 (3)
  • December 2016 (2)
  • November 2016 (2)
  • October 2016 (4)
  • September 2016 (1)
  • August 2016 (1)
  • July 2016 (1)
  • June 2016 (1)
  • May 2016 (2)
  • April 2016 (1)
  • March 2016 (14)
  • February 2016 (10)
  • January 2016 (19)
  • December 2015 (3)
  • November 2015 (5)
  • October 2015 (10)
  • September 2015 (9)
  • August 2015 (16)
  • July 2015 (13)
  • June 2015 (4)
  • May 2015 (2)
  • April 2015 (2)
  • March 2015 (7)
  • February 2015 (3)
  • January 2015 (22)
  • December 2014 (1)
  • November 2014 (5)
  • October 2014 (12)
  • September 2014 (5)
  • August 2014 (7)
  • July 2014 (41)
  • June 2014 (9)
  • May 2014 (12)
  • April 2014 (32)

Members Only

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org
Proudly powered by WordPress