Data Masking vs. Encryption

To develop an application or website or digitalize business processes, you must select protection means for essential data. There are two solutions: data masking and data encryption. This article will tell you in detail about these two approaches, the difference between them, and which one is more likely to fit your requirements. 

What is data masking?

Data masking or obfuscation is a privacy protection that provides complete or partial substitution of actual data by face ones that look true. Furthermore, unreadable symbols can substitute essential information. 

In health or popular science literature, you might have noticed that the author replaces actual names and surnames of patients with random names or initials. 

Another example of masking is hiding the information that helps identify a person. Namely, an organization database includes the employees' spreadsheet. The spreadsheet contains social insurance numbers, names, and surnames; data masking allows replicating the source database yet hides the social insurance number.

There are countless data types that masking can protect; still, the most common are:

• PII: personal information;
• PHI: protected health information;
• PCI-DSS: payment card industry data security standard
• ITAR: intellectual property. 

Data masking essentials

• Data masking must be irreversible. Once the data is masked, it must not be allowed to be extracted back from masked data. If masked data can be unmasked, it is a critical security issue, especially if they are in free access.
• Data must be representative. Regardless of the approach employed for data, it must remain relevant while the characteristics and structure — authentic. For instance, if data is in a spreadsheet, then the replicated file must be a spreadsheet too. If it stores the patient information, then masked data must be in this category. It is not permitted to change the names of people, city names, etc. Not only that, but geolocation and gender must remain. This information must be readable and numerically structured.
• Only private data is masked. Data masking is not necessarily applied to each field. For example, in the client record, it is not obligatory to conceal the gender and place of residence since, if masked, it will make the process more complex and expensive. At the same time, the category will be less beneficial for analytics and learning.
• Data masking must be automatic. Since the data frequently changes, the data masking must be automated. Else, data masking will be complex, time-consuming, expensive, and inefficient.
• The integrity must not be compromised. Data masking must not compromise the integrity of databases.  For example, if a credit card number is the primary key of a table and if it is encrypted for masking, each instance of that card number must be encrypted in the same way.

Data masking methods

Data encryption. It is probably the most complex and secure method of hiding data. To hide data, you will employ any encryption method. A special code will help to decrypt the data. This method is perfect for company production data since they require frequent decryption. The prime drawback is that if encryption key is compromised, any unauthorized party can decrypt data and access the company's source data if the encryption key is compromised. 

An example of substituting data. Source

Pseudonymization. This term is used by the EU General Data Protection Regulation (GDPR). According to this regulation, pseudonymization is any process that prevents data from being used to identify people. This generally means removing all direct identifiers and avoiding multiple identifiers that, in combination, can be used to identify a person.

What is data encryption?

Data encryption transfers readable information (text, code) into unreadable (encrypted text, code). Encrypted data require description via access key or password to be readable again. Usually, unique and automatic algorithms work on encrypting data on the internet. For instance, the connection between your browser and the website you use to access this text is automatically encrypted since the SSL certificate is employed. 

Two types of encrypted data

Data encryption often scrambles data and information into a sequence of random and unrecognizable characters. The encrypted information is then passed to the recipient, who holds the decryption key to turn the encrypted text into plain text.

Symmetric encryption. If encryption and decryption require the same key, then it is the symmetric type of encryption. Usually, it is employed for protecting idle data since one can securely pass the secret key to the receiving party. 

For the best experience with asymmetric encryption, you will need a key management system that employs critical public infrastructure to provide security and protection for public keys. 

Masking vs. encryption 

Data masking protects data by deleting any part of private data or substituting it with an analog structure with other values. On the other hand, encryption employs complex algorithms to transfer confidential information into an unstructured set of symbols (code), so the source information becomes unreadable without the secret key. 

Both tools have the same purpose, namely, protecting data. Since both means of protection use different approaches for the same target, it is vital to understand the difference, advantages, disadvantages, and which is better for a particular case. 

Data employment. Masking protects the information on each process regardless of whether it is idle or used. Furthermore, it is possible to mask all data at a time, a separate unit, category, or data about a specific person. Furthermore, with masking, there are no identifiable links to accurate data; hence, the information is secure for public sharing and protected from hackers. 

Therefore, masking is an excellent instrument for protecting confidential information in public sources; for example, names and surnames of patients in health literature, credit card numbers, and social insurance in banks, tax, or police reports. Also, masking is highly-recommended for following PCI DSS, CCPA, GDPR, HIPAA, etc. law requirements on protecting personal information.

Data encryption is perfect for protecting unstructured data (text, images, audio, video, etc.) for idle and employed scenarios. Hence, the traffic in the network is encrypted but not masked since it is easier, faster, and cheaper.

The requirements for data. As mentioned above, masking requires well-structured data. In other words, you must be able to highlight the necessary information within the structure and substitute it with synthetic data or unreadable symbols. Frequently, it is the main difficulty in employing the masking method. 

For example, if you have to record and share a private video, it will be awkward to mask confidential data (cat plates, faces, logos), even if it is published on YouTube. Therefore, it is much easier to encrypt the video, share it, and mask the required objects. 

Irreversibility. Masking data is irreversible, while encrypted information can be decrypted with the secret key. It’s essential if it requires sharing information about an investigation, yet the details on the witnesses or detective must be hidden.  

Selectivity. The other essential difference between masking and encryption is that masking can be employed on particular elements. Namely, masking protects specific information like names, surnames, locations, and account balances. 

Security. Each approach offers its pros and cons. The irreversibility of masking makes it perfect for protecting confidential information in public reports and databases. For instance, Google Maps masks faces and car plates. Furthermore, masking allows distinguishing the access levels for users. 

For example, if you have a database of store consumers:

• Call-center employees can see the contact data of your clients (phone numbers, emails, names, and surnames).
• Financial office employees see the full name, contact data, and purchase statistics.
• Security specialists can see any information, including bank cards and accounts. 

Availability. Both data masking and encryption are now available to every Internet user; the web is full of befitting applications (paid and free). However, if you need to mask information, it can be difficult if your data is structured in a way unfamiliar to the application (the masking algorithm). 

Whereas data encryption usually requires no effort. For example, you can simply archive your data with RAR or ZIP protocols and put a password on the archive - that's how most people encrypt their sensitive data. 

Final thoughts

Masking data and encryption are excellent instruments for data protection. Understanding their differences will help you select a solution for securing your critical information. The grounded decision you make will provide you with solutions that meet your requirements and the needs of your business.