Install Oracle Database 10gR2 or Oracle Database 11gR1.

Install the Sample Schema that comes with Oracle Database 10gR2 or Oracle Database 11gR1.

Upgrade your Oracle Enterprise Manager 10gR2 installation to Oracle Enterprise Manager Grid Control 10gR4 using the 10.2.0.4 patchset.

Download and unzip the datamask.zip file into your working directory.

This tutorial assumes that you have created some mask formats in the EM Repository. To load the mask formats, open a SQL*Plus session from your working directory and executed the following script:

@dm_rule_setup

Note: you will be prompted for the EM gridcontrol user.

There are also some other change you need to make to your default HR schema to support the data masking scenarios in this tutorial. From your SQL*Plus session, execute the following script as your HR user.

@dm_changes

Note: If you want to refresh your HR user schema after this tutorial, you need to run the default demo schema creation script which is mksample.sql in the $ORACLE_HOME/demo/schema directory.

Open a browser and enter the following URL to log in to Oracle Enterprise Manager 10g (change the <hostname> to localhost or your specific hostname).

http://<hostname>:4889/em

Login as the user you created when you installed Oracle Enterprise Manager and click Login.

Click the Targets tab.

Click the Databases tab.

Select your database from the list or enter search criteria and click Go.

Select your database from the list (if you entered search criteria in the previous step).

Click the Administration tab.

Scroll down the page and under Data Masking, select Definitions.

Select the Format Library link under Format Library.

The format library contains a centralized set of data masking format masks for commonly used sensitive data. For example, there are mask formats for phone numbers, social security numbers, credit card numbers, and fictitious first and last names. Security administrators can define these mask formats and maintain them in the format library to be used by the DBAs across the entire enterprise. Select the Bay Area Phone Number mask.

Notice that the phone number format is created using three types of mask primitives. First, the array lists consist of a set of area codes, followed by a fixed string, followed by a 4 digit random number. The Data Masking Pack provides mask primitives for characters, numbers or digits and dates to allow the administrators to construct any type of mask formats quickly and easily. Click Return.

Now you will create a new masking format. From the Format Library page, click Create.

Enter a name, in this case, 01_CR_DR_LICENSE, and make sure Array List is selected from the drop-down list and click Go.

Enter the List of Values A,B,C,D and click OK.

The Array List type was created. Select Random Digits and click Go.

Enter Start Length of 7 and End Length of 7 and click OK.

The Random Digits type was created. Notice that the types were used to generate some samples of the defined format. Click OK.

The Masking Definition for California Driving Licenses has been created. Click the Database breadcrumb to return to the Administration page.

From the Administration tab for your database, under Schema: Database Objects, select Tables.

If your preferred credentials are not set, you will receive the login window. Login as the SYSTEM user.

Enter your HR user for Schema and enter EMPLOYEE for the Object Name and click Go.

To view the data, select View Data from the drop-down list box and click Go.

So that you can compare the data after the data masking definition is applied, you want to leave this window open and open another tab or window in your browser. Right-click the Database breakcrumb and select Open Link in New Window (or a New Tab for browsers that support Tabs).

From the Administration tab for your Database, under Data Masking, select Definitions.

On the Masking Definitions page, click Mask.

You need to select the columns you want to include in this mask definition. Enter a name and under columns click Add.

There are several ways by which sensitive data can be identified. One recommended approach is to identify the sensitive data by tagging the associated sensitive columns with a keyword, such as MASK. Enter your HR user for the Schema and MASK% for the Comment Name and click Search.

In this example, there is a custom table called MANAGERS that is a part of the HR application but its constraints including foreign key relationships are enforced in the application. The MANAGERS table uses EMPLOYEE_ID as its driver table but the relationship is not registered in the database as a constraint, therefore, you need to add a Dependent column on the EMPLOYEE_ID column. Click the + for the EMPLOYEE_ID column under Add for Dependent Columns.

Enter your HR user for the Schema and MANAGERS for the Table Name and click Search.

Select the MGR_ID column from the list and click Add.

The dependent column was added. Now you can define the mask format of the EMPLOYEE_ID column. Click the Format icon.

Select Random Numbers from the Add drop-down list and click Go.

Enter 100000000 for Start Value and 999999999 for End Value and click OK.

Click OK.

You want to mask a few more columns. Under Columns, click Add.

This time enter your HR user for the Schema and EMPLOYEES for the Table Name and click Search.

Notice that this time all the columns in the EMPLOYEES table are listed, not just the columns that contain a COMMENT with MASK in its name. Select the following columns from the list and click Add.

FIRST_NAME
LAST_NAME
PHONE_NUMBER
SALARY

Select the Format icon for LAST_NAME.

You can again use the format already defined in the Format Library. The Format Library allows administrators to maintain central definitions of the standard mask formats so that they can be used by the DBAs across the enterprise. Click Import from Library.

Select Anglo American Last Name and click Import.

Click OK.

Select the Format icon for FIRST_NAME.

There is already a format defined for this column. You can import it from the library. Click Import from Library.

Select Anglo American First Name and click Import.

Click OK.

Select the Format icon for PHONE_NUMBER.

Click Import from Library.

Select Bay Area Phone Number and click Import.

Click OK.

Select the Format icon for SALARY.

For this column you want to randomly shuffle the original column data. Select Shuffle from the Add drop-down list and then click OK. Note: You cannot combine a column using this format type with other format types, such as Random Numbers or Random Strings.

You have defined all the columns that you want to mask data for. Click Next.

A window appears indicating that a Masking Script is being generated.

Review the warnings and the space check messages and click Next.

Enter a job name and click Next.

View the script in summary and full form by switching between the radio buttons. Note that you can save the script as well. When done, click Submit.

The job was submitted successfully. Click View Job Details.

The job completed successfully. Now you can compare the masked data against what was previously in the table. Click Targets and then select your database. Click the Administration tab and then click the Tables link under Database Objects.

Enter HR for Schema and EMPLOYEES for Object Name and click Go. Compare the data against the other window you previously had open. Notice that the data for the columns you defined a mask for is now changed.

Navigate back to the Administration page for your database. Under Data Masking, select Definitions.

Select Masking Definition from the search drop-down list and enter Search Criteria that identifies your definition and click Go.

Select your masking definition and click Export.

Click Export.

Open the HR_MASK.xml file in a text editor and change the following elements:

DEFINITION_NAME: <name for your masking definition> (i.e. HR mask in XML)
TARGET_NAME: <your database>
OWNER: <your HR user> (you need to change for each masking column)

Switch to Enterprise Manager and from the Masking Definition page, click Import.

Enter the location of the XML file and click Continue.

Select the import masking definition and click View.

You want to navigate to the EMPLOYEES table and view the data.

Right-click on the Database breadcrumb and select either to open a new window or tab. This allows you to compare the data with the data after it is masked at the end of this topic.

Enter your HR user for the Schema and EMAIL_MASK for the Object Name and click Go.

The function you use for this topic was already loaded in the prerequisites scripts. Select the Function EMAIL_MASK and click View.