Yesterday morning I woke to find an interesting article in ‘The Observer’ about anonymizing or masking personal data records. This turned out to be somewhat ironic considering I wrote two blogs on this very topic just last week!

The article, written by Anushka Asthana (Policy Editor), discussed the concerns around using data masking or “anonymization techniques” to de-identify sensitive and personal information. Many large and well-known multi-national organizations and government agencies are using data masking methods to keep their production data secure (or anonymous) when they use it in development and test.

Anushka’s article, however, states that computer scientists in the US have discovered ways to “re-identify” the personal information of individuals who were included in anonymous datasets. How?, through using a statistical “de-anonymization” technique or, as my last blog suggested, re-engineering of masked test data.

So, as Anushka’s article asks, just how safe is it to share personal and sensitive information even if it is masked or de-identified? The answer, once again, is not very.

Organizations should start looking into other methods to secure their production data when using it outside of their “live” environment; whether this be for testing, development, training, QA or even presenting statistical information. My last two blogs discuss the option of using ‘data creation’ techniques. No, this isn’t the process of “creating” or making-up some data based on whatever fake names or addresses come into your head. It’s quite a sophisticated process, and the end-product is secure test data that can never be re-engineered. It’s based on a model of your production environment, so the data maintains referential integrity and is exactly like “live” data, but it isn’t. Read my last two blogs to find out more.