Dynamic Data Masking Best Practices for the MDM Hub
Dynamic Data Masking Best Practices for the MDM Hub
You can use
Dynamic Data Masking
effectively in the
MDM Hub
with the help of suggested best practices.
Best practice to create
Dynamic Data Masking
rules in the Rule Editor
Dynamic Data Masking
evaluates rules in the Rule Editor from the top to the bottom. Therefore, if you create non-masking rules, you must put them above any masking rules you create so they can be effective.
Best practice to allow users to view unmasked data
Dynamic Data Masking
does not mask data in the database. When you view data in the
MDM Hub
, the data appears masked. Use Create View statements in
Dynamic Data Masking
to give users privileges to view unmasked data.
Best practice to block users
To block users from adding a record to which masking is applied, you must create a separate rule for each affected base object. Define a text matcher as
%INSERT%<BO_NAME>%<ROLE NAME>%
and the Block Statement processing action.
Best practice to allow users to update masked data
By default, the
Dynamic Data Masking
engine prevents users from editing tables with masked data. If you want to update masked data in the
MDM Hub
, you can create a rule in the
Dynamic Data Masking
Rule Editor to allow a user to update masked columns.
Best practice to create rules with MDM_SYSTEM indicator
In the
MDM Hub
, the user MDM_SYSTEM is an internal indicator for system calls. MDM_SYSTEM does not appear in the roles list in the
Hub Console
.
Dynamic Data Masking
applies masking based on the
MDM Hub
roles that a user has. When you create
Dynamic Data Masking
rules in the Rule Editor, do not create rules for the MDM_SYSTEM indicator alone. YouChart of Accounts Installation and Configuration Guide must combine MDM_SYSTEM with a user name or roles that belong to a user. You can combine the MDM_SYSTEM indicator with any other rule to create fine-grained rules in