Dynamic & Static PII Data Masking (Anonymization & Tokenization)

Mask sensitive customer PII (credit cards, national IDs, emails, phone numbers) dynamically for lower-privileged roles and staging environments.

Target Compliance Frameworks

✓ KVKK Madde 12✓ GDPR Article 32✓ PCI-DSS Req 3.4✓ HIPAA Safe Harbor✓ SOC 2 Privacy

Key Security & Compliance Objectives

Anonymize production dumps before restoring to staging or QA clusters

Provide partial dynamic masking (e.g. 4543 **** **** 1234) for support staff

Allow BI analytics without exposing personally identifiable attributes

Enforce database-level masking rules independent of application layer

Architecture & Operational Mechanism

Dynamic Data Masking (DDM) alters query results on-the-fly based on session privileges. Static Data Masking (SDM) permanently transforms sensitive columns using irreversible pseudo-random generators during ETL or backup replication.

Reference Configuration File

-- PostgreSQL Anon (postgresql_anonymizer) veya SQL Server DDM Örneği
-- 1. SQL Server Dynamic Data Masking
ALTER TABLE dbo.Customers 
ALTER COLUMN Email ADD MASKED WITH (FUNCTION = 'email()');

ALTER TABLE dbo.Customers 
ALTER COLUMN CardNumber ADD MASKED WITH (FUNCTION = 'partial(0,"XXXX-XXXX-XXXX-",4)');

-- 2. Düşük yetkili kullanıcıya okuma izni (Maskeli görür)
GRANT SELECT ON dbo.Customers TO SupportRole;
-- UNMASK yetkisi verilmediği sürece maskelenmiş veri döner.

Step-by-Step Implementation Guide

Sequential execution procedures for verified production rollout.

PII Discovery & Classification

sql

Identify and classify all columns containing PII, financial, or sensitive attributes.

SELECT table_schema, table_name, column_name 
FROM information_schema.columns 
WHERE column_name ILIKE ANY (ARRAY['%email%', '%phone%', '%tc_kimlik%', '%card%', '%iban%']);

Define Masking Functions

sql

Attach native or extension masking definitions to sensitive columns.

-- PostgreSQL Anonymizer Örneği
SECURITY LABEL FOR anon ON COLUMN users.phone 
IS 'MASKED WITH FUNCTION anon.partial(phone, 2, "$$$$", 2)';

SECURITY LABEL FOR anon ON COLUMN users.email 
IS 'MASKED WITH FUNCTION anon.email()';

Enforce Masked Access by Role

sql

Enforce masked view for reporting and support roles while granting UNMASK only to verified processes.

CREATE USER support_agent WITH PASSWORD 'SecurePass!';
GRANT SELECT ON users TO support_agent;
-- support_agent 'MASKED' veri okuyacaktır.

Production Best Practices

✓Automate static sanitization in CI/CD before any production restore into staging or dev environments.
✓Enforce masking at the database engine level rather than relying solely on API business logic.

Common Pitfalls & Anti-Patterns

⚠Vulnerability to inference attacks via clever WHERE clause predicates on masked columns.
⚠Distributing raw production backup files to local developer laptops without automated sanitation.

Audit List Critical CVE Feed →