Embrace Obfuscation (Data Masking, Scrambling, etc) http://embraceobfuscation.com Sensitive Data Obfuscation, Sanitization, De-identifying, etc Tue, 10 Nov 2009 16:02:29 +0000 http://wordpress.org/?v=2.2.1 en Breach notification laws http://embraceobfuscation.com/2009/11/10/breach-notification-laws/ http://embraceobfuscation.com/2009/11/10/breach-notification-laws/#comments Tue, 10 Nov 2009 16:02:29 +0000 Embrace Obfuscation http://embraceobfuscation.com/2009/11/10/breach-notification-laws/ Breach Notification Laws are here to stay, folks.

California started it’s version in 2003, followed by Arkansas in 2005. Now 45 states have laws that require companies to notify residents of the respective states if their Personally Identifiable Information (PII) has been breached.

What’s next? - there are two current bills on the Senate floor in DC - both federal laws (meaning, they will supersede the state laws and that all companies nationally have to comply). One of them, by Leahy-VT, actually will permit more pervasive state laws to be in effect (for example, the far reaching Mass Privacy Law CMR 201 17) while the other, by Feinstein-CA, allows for “Safe Harbors” (meaning, if the breach was not malicious, then notification is not necessary).

Follow to this blog over the coming months for more information on such laws and how to comply with them.

Encouraging you to embrace obfuscation (TM),

Rajesh

MENTIS Software

]]> http://embraceobfuscation.com/2009/11/10/breach-notification-laws/feed/ What’s with the title? http://embraceobfuscation.com/2008/11/13/whats-with-the-title/ http://embraceobfuscation.com/2008/11/13/whats-with-the-title/#comments Wed, 12 Nov 2008 22:21:28 +0000 Embrace Obfuscation http://embraceobfuscation.com/2008/11/13/whats-with-the-title/ Have you seen “Eschew Obfuscation”? It is intended to bring about clarity in communications, and asking people to be straight-forward. But in the world of data security, we need to do the opposite. So, let’s embrace obfuscation!

Obfuscation, in the context of my discussons, means data masking - the substitution of sensitive information by similar and realistic looking information. Data Masking is a much worthy alternative to encryption - in terms of efficiency, time to implement, changes to existing process, etc.

Look for a posting that discusses Encryption vs Masking.

]]> http://embraceobfuscation.com/2008/11/13/whats-with-the-title/feed/ Reason to blog about data masking http://embraceobfuscation.com/2008/10/24/reason-to-blog-about-data-masking/ http://embraceobfuscation.com/2008/10/24/reason-to-blog-about-data-masking/#comments Fri, 24 Oct 2008 15:47:24 +0000 Embrace Obfuscation http://embraceobfuscation.com/2008/10/24/reason-to-blog-about-data-masking/ I have decided to join the rolls of the blogosphere by blogging about data masking. I founded a company in 2004 to address security issues in non-production ERP databases - and our solution was a product called iScramble (www.mentisoftware.com/iScramble.html) to address specifically the challenges when embarking on a data masking project, and to provide an automated, easy-to-use, quick-to-deploy solution for the same.

 Over the next several posts, I will talk about the need, the business case, lessons learned, and what to look for when selecting a masking product/ solution.

Your comments, suggestions, thoughts, critiques are most welcome!

Best,

Rajesh Parthasarathy

Data Masking advocate

]]> http://embraceobfuscation.com/2008/10/24/reason-to-blog-about-data-masking/feed/