Masking Data in SAS Visual Investigator
This article will discuss a newly added feature of SAS Visual Investigator: data masking. Keep reading to learn how you can leverage this feature to protect sensitive information in your Visual Investigator environment.
In this example, we'll be looking at an external data object Customer, representing customer data stored externally to Visual Investigator. Thus, data for the instances of this entity cannot be changed in Visual Investigator. However, Visual Investigator administrators can configure entity definitions to determine which data is displayed, and protect sensitive fields and information.
Here is an example of the Customer entity as it is currently configured. This page appears the same way in the user interface to an administrator, a manager, and an analyst. This is the view context.
Appearance of the Customer page to all users before data masking is applied.
The tax ID field in this case represents the social security number for the customer instance. Let's configure this entity so that this sensitive information is masked.
I switch back to my administrative interface - Manage Investigate and Search. I choose Data Objects on the menu bar. I double click the Customer entity to open it.
I navigate to the Fields tab of the entity and review the available fields.
Configuring the fields of the Customer entity
On this tab, I can add or remove entity fields to determine what is accessible in Visual Investigator. I can configure details abot the fields, including how they are indexed, whether each field is required, etc.
In this case, I click the Party Tax Id field to open the field properties.
I check the box next to Data Masking. There are a few things to consider when masking data. I click the warning icon next to the option to display a popup indicating some of these considerations.
Masking the Party Tax Id field
For example, you cannot create conditions on masked fields, and if you mask a field that is utilized in existing conditions, it might impact them. In this environment, I don't have any conditions, object labels, or other features configured to use this field, so I'll continue.
Selecting the groups with permission to unmask the data
I click the users icon next to "Authorized to reveal masked data". I choose sviadms (Visual Investigator Administrators), and click OK.
Now, only users in the administrators group will be able to unmask this field.
I click OK again, and then save the entity. I click the More icon and then select Re-index this entity so that the changes can take effect.
I'll finish by looking at the Customer page in the Investigate and Search interface again.
First, I'll remain signed in as my administrator. I search "James" and review the search results. The Tax ID field has been obscured.
The Tax ID field is masked in the search results.
I click James Hurst to open the entity page. This page also has the Tax ID field obscured.
Masked data on the Customer page. Clicking the eye icon unmasks the data.
I click the eye icon to unmask the data.
the unmasked Tax Id field
In this case, I am signed in as an administrator, which we have authorized to unmask this field.
This is how the page appears to another user who is not in the Administrators group:
Now, the Tax ID field has been restricted for all Customer entities to only Administrator users. This is just one way that you can configure your Visual Investigator environment for your needs. For more information on configuring data masking and other settings and properties of Data Objects, see the Visual Investigator Administrator's Guide.
