Data Masking: 8 Critical Questions Businesses and Developers Ask About Protecting Sensitive Data
Garda expert Dmitry Larin shares insights from the webinar 'Data Masking: Battle of Opinions', answering frequent questions about protecting sensitive information in test and development environments.
Many organizations secure production databases rigorously while leaving test environments exposed. Developers, contractors, and analysts often access real customer names, payment details, and transaction records because test segments receive only basic network controls. Masking addresses this internal threat that encryption cannot fully mitigate once legitimate access is granted.
Encryption of entire databases can severely degrade performance, as seen in one client case where query speeds dropped dramatically. Masking offers a lighter alternative that keeps data in readable text format, enabling deduplication and compression during backups. The two technologies complement each other: encryption protects against external theft while masking controls what internal users see.
Improper masking can break applications if data loses semantic structure. Effective solutions replace real values with synthetic equivalents that preserve formats, indexes, and relationships, allowing applications to function normally. Organizations can also reduce database size for testing while maintaining required scenarios.
Static masking creates fully detached copies for developers or contractors. Dynamic masking intercepts queries in production to return masked results based on user rights. Selective masking targets specific records such as data of former employees, and streaming masking processes high-volume transfers to analytics platforms without latency requirements of dynamic methods.
Regular expressions outperform ML models on structured fields like passport numbers, while machine learning excels at extracting personal data from unstructured text such as call-center comments. Garda Data Masking combines both approaches with manual verification options.
Processing 5 TB of PostgreSQL data can take 14 hours, and copying 5 TB over a gigabit link requires 11-12 hours. Incremental masking, compressed copies, and careful scheduling outside business hours help balance speed and system load. Resource planning is critical, as demonstrated by a 30 TB pilot that failed because the target VM had only 10 TB capacity.
Custom scripts struggle with multiple database types including PostgreSQL and Oracle, schema changes, and custom data formats. Specialized tools allow reusable rules and proper access-right management that scripts cannot provide.
Related articles
Amnezia VPN Survives Coordinated Russian Censorship Campaign Targeting AmneziaWG Protocol Fingerprints
Amnezia VPN has published a detailed post-mortem on the multi-wave blocking campaign conducted by Russian authorities against its Amnezia Free and Amnezia Premium services during June and July. The company describes a shift from simple protocol blocking to sophisticated fingerprinting of AmneziaWG traffic combined with infrastructure DDoS attacks and automated IP-subnet blacklisting. Engineers closed multiple detection vectors including zero-length UDP packets, fixed-size keepalive messages, handshake timing patterns, and nonce zero bytes. The incident forced accelerated migration to AmneziaWG 2.0, discontinuation of legacy client support, and development of AmneziaWG 3.0 while expanding VLESS infrastructure as a backup. Self-hosted users largely avoided direct protocol blocks but still faced subnet-level restrictions. The report highlights how Roskomnadzor now applies cumulative scoring across multiple traffic features rather than single definitive markers.
MAX Desktop Client Tested for VPN Detection on Windows, No Tracking Signs Found
A Habra user named Slava_B conducted an experiment on September 8, 2026, to determine whether the MAX desktop client on Windows could detect or route traffic through a VPN configured at the router level. The setup used a Keenetic router that directed Russian resources directly while sending other connections via an OpenConnect tunnel to a European VPS, with no VPN client or virtual adapter present in Windows itself. Monitoring tools including Process Monitor, Wireshark, TCPView, and tcpdump revealed that MAX.exe and MAX-service.exe processes communicate locally and connect to MAX/ONEME infrastructure along with AppTracer services. The application repeatedly accessed MachineGuid, computer name, proxy settings, device IDs, and microphone/camera information, though these reads may support diagnostics and anti-fraud functions. No connections appeared on the VPN interface, and the client did not attempt to reach IP-checking services, Telegram, or WhatsApp. The researcher noted that TLS traffic was not decrypted, so actual transmission of identifiers could not be confirmed, and results apply only to this router-based configuration.
PII-Guard: Open-Source Detector for Personal Data in Russian Text
Andrey Ivanov, an NLP researcher at red_mad_robot, has released PII-Guard, an open-source system that detects and masks personal data in Russian text before it reaches language models. The tool combines rule-based checks with a fine-tuned ruBert-base NER model to handle names, addresses, phones, passports, INN, SNILS, bank cards and other entities. It replaces detected PII with structured XML-like tags that preserve grammatical information such as gender and entity ID, allowing models to generate coherent responses that are later restored with real values. The hybrid pipeline first applies normalization, pattern matching, Luhn and weighted checksum validation, and context windows with positive and negative keywords, then merges results with model predictions via an arbitration module. Evaluation on four public datasets, including Hivetrace, alexen2 and alrosait, shows PII-Guard outperforming other open solutions on both strict span matching and type-overlap micro-F1 metrics. The project, including datasets and code, is available on GitHub and aims to reduce leakage risks while maintaining downstream model utility.
Google to Add Explicit Content Warnings in Android System Photo Picker
Google is preparing a new safety feature for the system photo picker in Android that will scan images and videos for explicit or nude content. The tool is designed to warn users before they share intimate photographs, whether accidentally or due to a momentary lapse in judgment. This functionality will operate at the system level, meaning it applies across multiple apps that use the built-in photo selector. The feature aims to reduce the risk of unintended distribution of private images that could lead to embarrassment or privacy violations. By integrating the check directly into Android, Google seeks to provide a consistent layer of protection without requiring third-party applications to implement similar logic themselves.