I have spent the last week learning about new features in SQL Server 2016 and one that I want to play with is Dynamic Data Masking (DDM).
What is data masking? It is a way to change or hide sensitive data. If I want to hide an email address that is Batgirl@DC.com, I could either change it to be Batwoman@Heros.com using a masking software or I could use DDM to cover it like this BXXXXX@XXXXXX.com. I can also determine how many letters I want to cover with the masking in DDM.
If you want to permanently mask it for security purposes and force it to never link back to your production data, SQL Server Dynamic Data Masking (DDM) is not for you. The built-in feature only applies a mask over the top, it doesn’t actually change the data that is stored in the database. Think of SQL Servers’ version of data masking like a Halloween mask that sits on your face as opposed to plastic surgery that will forever change the way you look.
SQL Servers’ DDM will mask data to users that you set up to see the mask. This is helpful for reporting or for curious people who want to look at data they shouldn’t be viewing. It will not hide the data from privileged users. It will not protect your data from someone taking a backup and restoring it somewhere else (If you want that, try Alway Encrypted instead). As a side note, DDM and Alway Encrypted won’t work together on the same column.
Now let’s get ready to play with Dynamic Data Masking in SQL Server. (Coming next month)
Today’s song is Dirty Laundry by Carrie Underwood .