Download eBook (PDF) - Red Gate Software

8 – ObfuscationAny proposed modifications to a production database should be firstimplemented and tested on a development or test database. In order to ensurethe accuracy of this testing, the development database should mimic theproduction database as closely as possible, in terms of the data it contains andthe set of security features it implements.This means that all of the sensitive data efforts and options noted in this bookapply to both environments and that it may be necessary to store sensitive datain both the development and production databases. The difficulty with this isthat it is common for developers and testers to be granted elevated permissionswithin the development database. If the development database containsidentical data to that stored in the production database, then these elevatedpermissions could present a severe and intolerable security risk to theorganization and its customers.In order to mitigate this risk, the Database Administrator responsible forrefreshing the contents of the development environment should applyobfuscation methods to hide the actual values that are gleaned from theproduction environment.Obfuscation MethodsThe word obfuscation is defined by the American Heritage Dictionary asfollows:"To make so confused or opaque as to be difficult to perceive orunderstand … to render indistinct or dim; darken."The word obfuscation, at times, can be used interchangeably with the termobscurity, meaning "the quality or condition of being unknown". However,there is a subtle difference between the two terms and the former definition ismore appropriate since obscurity implies that the hidden condition can beachieved without any additional effort.Many methods of "disguise", or obfuscation, are available to the DatabaseAdministrator that can contribute a level of control to how sensitive data isstored and disclosed, in both production and development environments. Theoptions that will be discussed in this chapter are:• Character Scrambling• Repeating Character Masking• Numeric Variance• Nulling172