About Inline Masking and Subsetting

You can reduce the size of the database simultaneous with masking sensitive data. This serves the dual purpose of obscuring exported production data while greatly reducing hardware costs related to storing large masked production databases for testing.

Note:

Inline masking is available only with Oracle Database 11g and higher releases.

The benefits of integrating data masking with subsetting include the following:

  • Prepare the test system in a single flow

  • Avoid the necessity of maintaining large-size masked databases for test purposes

  • Exported data in the form of a dump file can be imported into multiple databases without exposing sensitive data

  • Subsetting is enhanced by ability to discard columns containing chunks of large data

You can select one or more data masking definitions during subset creation. The masking definitions must be based on the same ADM as the current subset definition. At the same time, you can significantly reduce the subset size by defining column rules to set CLOB and BLOB columns to null (or another supported format such as Fixed String, Fixed Number).

You generate a subset in two ways:

  • Export Dump–if masking definitions are part of the subset model, mapping tables are created during generation, and the resulting dump contains masked values

  • In-Place Delete–subsetting is performed on a cloned copy of the production database; if data masking is part of the subset model, pregenerated masking scripts are executed on the target sequentially

Advantages of inline masking include the following:

  • Sensitive data never leaves the production environment and thus is not exposed (Export Dump option).

  • There is no need to temporarily store data in a staging area.

  • Exported data can subsequently be imported into multiple environments.

  • You can define table rules to export only a subset of data, and can further trim the volume by using column rules to eliminate large vertical columns.

  • You can mask the same data in different ways and import into different test databases.

  • You can use the provisioning framework to create multiple copies of trimmed down, referentially intact databases containing no sensitive data (in-place delete), or import a dump file into multiple databases (export dump).

The section "Creating a Data Subset Definition" includes instructions for combining data subsetting and data masking within the process of creating a subset definition. See Masking Sensitive Data,for information on data masking and creating a data masking definition.