A group of developers needs access to a database in a development environment, but the database contains sensitive dat a. Which of the following…

Data masking (or data obfuscation) is the process of replacing sensitive data with realistic but non-sensitive, fictional data. This is the most appropriate solution because it allows developers to work with a database that is structurally and functionally identical to the production environment, which is crucial for accurate development and testing. By masking the data, the database administrator ensures that developers can perform their tasks without being exposed to confidential or personally identifiable information (PII), thus balancing development needs with security requirements.

A. Audit access to tables with sensitive data.

Auditing is a detective control that logs access events. It does not proactively prevent developers from viewing the sensitive data itself.

B. Remove sensitive data from tables.

Removing entire columns or rows of data could alter the database schema and referential integrity, potentially breaking the application and rendering the development environment useless.

D. Encrypt connections to the development environment.

Connection encryption (e.g., TLS/SSL) protects data in transit from network eavesdropping but does not protect the data at rest or prevent an authorized developer from viewing it once connected.

1. Microsoft SQL Server Documentation

"Dynamic Data Masking": "Dynamic data masking (DDM) limits sensitive data exposure by masking it to non-privileged users... DDM is useful to prevent unauthorized access to sensitive data... by allowing them to query the database for development purposes... without exposing the sensitive data." (Microsoft Docs

Dynamic Data Masking

Introduction section).

2. Oracle Database Documentation

"Data Masking and Subsetting": "Data Masking... is the process of replacing sensitive information with fictitious

but realistically looking data... Typically

you mask data when you need to create a non-production environment

for example

for testing or development purposes." (Oracle Help Center

Oracle Database 19c

VLDB and Partitioning Guide

Chapter 13

Section 13.1).

3. NIST Special Publication 800-53 Rev. 5

"Security and Privacy Controls for Information Systems and Organizations": Control SI-3

"Information Handling and Retention

" discusses the need to handle and protect data throughout its lifecycle. The implementation guidance often involves minimizing data in non-production environments

a principle directly achieved through data masking. (NIST SP 800-53 Rev. 5

Page 269

SI-3).