What is data masking?
Data masking replaces part or all of a sensitive value with substitute characters or realistic fake data. The result still does its job, whether that is confirming a caller's identity, testing an application or training an analyst, but it no longer exposes the real value to the person or system looking at it. A Social Security number shown as ***-**-6789 and a card number shown as **** **** **** 4821 are the familiar examples.
Static vs. dynamic masking
Static data masking permanently changes a copy of the data. The usual case is a test or development database built from production: names are swapped for fake names, card numbers for fake numbers in a valid format, dates of birth shifted and column values shuffled between rows. The masked copy is realistic enough to test against, contains no real customers and cannot be turned back into the original.
Dynamic data masking leaves stored data unchanged and masks it at query time, based on who is asking. Several database platforms support it. In Microsoft SQL Server, for example:
ALTER TABLE Employees ALTER COLUMN SSN ADD MASKED WITH (FUNCTION = 'partial(0,"XXX-XX-",4)');
Users without the UNMASK permission then see XXX-XX-6789, while an HR application granted UNMASK reads the full number. SQL Server's built-in email() mask works the same way and shows an address in the form aXXX@XXXX.com.
Common masking techniques
- Character masking: replacing characters with X or asterisks while leaving a few visible.
- Substitution: swapping real values for realistic fake ones drawn from a lookup list.
- Shuffling: moving values between rows so no record keeps its own.
- Variance: shifting dates or numbers by a random amount within a range.
- Nulling or redaction: removing the value entirely.
Masking also supports compliance. PCI DSS v4.0.1 requires card numbers to be masked when displayed, so that anyone without a business need to see more sees at most the BIN (the issuer prefix) and the last four digits.
Limits of masking
Dynamic masking is a display control, not an access boundary. Someone who can run arbitrary queries can sometimes infer masked values, for example by filtering on salary ranges until a single row matches, so it must sit on top of proper permissions. Static masking has to keep data consistent enough to be useful, such as the same fake customer ID in every related table, and careless masking can still leak real information through fields nobody touched, such as free-text notes.
Data masking vs. tokenization vs. encryption
| Method | Can the original come back? | Typical use |
|---|---|---|
| Static masking | No, the copy holds fake values | Test and development data |
| Dynamic masking | The stored value is untouched; viewers see only part of it | Support and call center screens |
| Tokenization | Only by asking the token vault | Card numbers, PCI DSS scope reduction |
| Encryption | Yes, with the key | Data at rest and in transit |
Data masking on the CompTIA Security+ exam
Data masking is one of the data protection methods in SY0-801 objective 3.3, which covers how organizations protect the data they hold and when each method fits. "Developers need realistic data without real customer records" points to static masking. "Agents should see only the last four digits while billing still uses the full number" points to dynamic masking. Distractors include tokenization (it replaces the stored value and depends on a vault), encryption (it protects data but shows nothing useful until decrypted) and hashing (it cannot display part of a value at all).