GDPR is upon us. But there’s an elephant in the room: multiple silos of test and development data. There’s likely way more islands of it than you think—often containing a treasure trove of all too sensitive, weakly masked ex-production data.

1. © 2017 Delphix. All Rights Reserved. Private and Confidential.© 2017 Delphix. All Rights Reserved. Private and Confidential.
Gary Hallam | Global Channel Enablement, Delphix
GDPR Fast Start
March 28, 2018

2. © 2017 Delphix. All Rights Reserved. Private and Confidential.
1 GDPR Key Articles and Security Controls
2 Non-Production Data
3 Virtualisation
4 Profiling
5 Masking & Tokenization
6 Self-Service
7 Replication
8 Summary & Case Studies
Agenda
2

3. © 2017 Delphix. All Rights Reserved. Private and Confidential. 3
Personal Data
“
‘personal data’ means any information relating to an identified or identifiable
natural person (‘data subject’); an identifiable natural person is one who can
be identified, directly or indirectly, in particular by reference to an identifier
such as a name, an identification number, location data, an online
identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of
that natural person
”
- Article 4

4. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Key Articles of GDPR
4
BREACH
NOTIFICATION
Responsibilities
PROTECTION
OFFICER
CONSENT
RIGHT TO BE
FORGOTTEN
PROFILING
PROTECTION
CROSS BORDER
TRANSFERS
The key articles of GDPR require that
personal data is managed and protected
effectively and enshrines that protection in
law with significant penalties if those laws
are broken.
Article 33 Article 37, 38 & 39 Article 7
Article 45 & 45 Article 22 Article 17

5. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Security Controls
There exist 2 controls that allow you to
be exempt and/or relaxed from GDPR
responsibilities. Anonymization &
Pseudonymization.

6. © 2017 Delphix. All Rights Reserved. Private and Confidential. 6
Pseudonymization
“The principles of data protection should
apply to any information concerning an
identified or identifiable natural
person…..principles of data protection
should therefore not apply to
anonymous information, namely
information which does not relate to an
identified or identifiable natural person or to
personal data rendered anonymous in
such a manner that the data subject is
not or no longer identifiable. This
Regulation does not therefore concern the
processing of such anonymous information”
Anonymization
“‘pseudonymisation’ means the processing
of personal data in such a manner that the
personal data can no longer be
attributed to a specific data subject
without the use of additional
information, provided that such additional
information is kept separately and is
subject to technical and organisational
measures to ensure that the personal data
are not attributed to an identified or
identifiable natural person”

7. © 2017 Delphix. All Rights Reserved. Private and Confidential.© 2017 Delphix. All Rights Reserved. Private and Confidential. 7

8. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Non-Production Data Represents a Major Hidden Risk
NON-PRODUCTION (80%)
PRODUCTION DATA (20%)
» Is constantly growing
» Entails multiple types of repositories
» Is often less protected by security and
governance measures
» Contains data subject to GDPR
Non-Production Data:
8

9. © 2017 Delphix. All Rights Reserved. Private and Confidential.
A Comprehensive Approach to Non-Prod Data Security
SECURE
APPLY automatic or
custom masking with
consistency,
repeatability
DISCOVER
IDENTIFY sensitive
data and create an
enterprise-wide risk
profile
DELIVER
DISTRIBUTE secure
data to non-production
environments in
minutes
9

10. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Delphix Dynamic Data Platform
Deliver masked data in just minutes
Application
s
File
s
Database
s
Rich APIs
DD
Controls
Self
Service
Datapod
s
On-
Prem
Any
Server
Private
Cloud
Public
Cloud
Sync
Compress
Provision
Profiling
Compliance
Policy
Masking
Distribute
Audit &
Report
Manage
VIRTUALIZE SECURE MANAGE
DBA
10

11. © 2017 Delphix. All Rights Reserved. Private and Confidential.
How Virtualisation enables a Fast Start
Sync
Compress
Provision
Replicate
VIRTUALIZE
11
• Easy to deploy
– Import a Virtual Machine
• Reduced infrastructure requirements (storage)
• Parallelised Environments
– Testing a masked database on multiple applications
– Out of band masking – no “please wait whilst we mask your
system”
• Masking for purpose and ad hoc masking

12. © 2017 Delphix. All Rights Reserved. Private and Confidential.
How “Actionable” Profiling enables a Fast Start
12
• Ability to examine your data to locate sensitive data
• Customisable Profiles using Regular Expressions
• Build application, compliance-rule, language, department specific
profiles
• Run profiles against multiple data sources
• Profile matches suggest masking algorithms
• Re-profile data to maintain compliance
Profiling
Compliance
Policy
Masking
SECURE

13. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Profiling – How to build portable profile rules
15
• Out of the box profiles help to identify sensitive
data
– Data level profiling
– Meta-data level profiling
• Ideally a Profile Set should yield all sensitive
data accurately
• Customisable to prevent false positives and
false negatives
• Subject Matter and Security Experts need to
qualify
• Additionally secure data can be found using
data discovery techniques – for instance,
columns with high distinct value count.

14. © 2017 Delphix. All Rights Reserved. Private and Confidential.
• Intelligent: Solution that can identify sensitive
data and know how to mask it. Feature: Pre-built
accelerator pack for standard SAP tables.
• Speed: High performance masking solution.
Feature: Database level masking for only
transparent tables. No support for pool/cluster.
• Referential Integrity: Referential integrity across
different database types and applications.
Feature: Data Source agnostic algorithms.
A high performance out of the box masking
solution that can work alongside masking of
other data sources.
An Example of a Portable Profile Rule
Delphix SAP Masking
16
for
SAP

15. © 2017 Delphix. All Rights Reserved. Private and Confidential.© 2017 Delphix. All Rights Reserved. Private and Confidential.
“You’re Masking UI
is very nice but we
have thousands of
databases to
protect.”
17

16. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Introducing the Masking API
18
• The Delphix Masking API allows you to build
and run your masking rule-sets and profile-
sets programmatically.
• Automatically profile an entire database estate,
for instance by supplying a list of databases
and connection strings.
• An API Client user interface allows novices to
learn, execute and build the commands
needed to automate masking.
• Allows you to implement on-the-fly masking*
https://bit.ly/2pHa4Sd

17. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Masking
Masking should be a one way process to
prevent re-identification of data – in this
way data can be anonymised. The data
subject may be inferred from other data,
hence the masking should be
comprehensive and approved.

18. © 2017 Delphix. All Rights Reserved. Private and Confidential.
• Mask across all data sources
– Leveraging the same rules/algorithms
– Key fields can be masked
– Automatic drop and re-build constraints
• Deterministic Masking
– Same masking across all data types
– Removes the need for detailed data analysis
• Secure Lookups
– Simplify masking process
– Secure and irreversible
– Patented technology
• No Code / Low Code Approach
Keeping It Simple
Keeps it Fast
✓ REALISTIC ✓ IRREVERSIBLE ✓ REPEATABLE
✓ REFERENTIAL
INTEGRITY
20

19. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Out of the Box Algorithms
Used to build custom algorithms
1.
2.
3.
4.
5.
6.
7.
8.
21

20. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Pre and Post Script Processing
Provides additional complex masking capability
• In order to cater for more complex
requirements Delphix provides a facility
to add scripts before and after a
Ruleset has run.
22

21. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Custom Algorithms
Can be developed, subject to approvals
• Bespoke algorithms may be created
using Pentaho Data Integration
• This is a gated development that
requires approvals
– Prevents duplicating algorithms
– Ensures sensible algorithms are
created in-line with best practices.
23

22. © 2017 Delphix. All Rights Reserved. Private and Confidential.
• Tokenization provides the
ability to re-identify data.
• Good for psuedonymisation
• Useful for sharing data for
processing and then re-
identifying once processing is
complete
• Less secure than masking as
this data can be reversed
• Helpful where full masking
across the enterprise cannot
be completed.
Tokenization

23. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Data Pods
Self Service for testing Masked Data
25
DATA OPERATORS
• Secure
• Virtualize with compression
• Automate
• Replicate
• View and Manage test &
copy data environments
across users
DATA CONSUMERS
• Bookmark
• Version
• Refresh
• Restore
• Branch
• Share
Personal Secure Portable DynamicLightweight

24. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Mask virtual copy
one time
Repeatable and Secure Data Delivery
Mask once, deliver many
26
Production
Source
DEV
QA
• Provision a complete, virtual copy of production
• Automatically discover and mask sensitive data
• Distribute multiple masked copies packaged in data pods
• Provide testers with self-service control
• Easily refresh data copies
Distribute secure
copies in minutes

25. © 2017 Delphix. All Rights Reserved. Private and Confidential.
CLOUD
Enable Secure Dev/Test in Hybrid Cloud Architectures
27
ON-PREMISE
Production
Source
DEV
QA• Synchronize with on-prem source
• Compress and mask data
• Replicate secure data to cloud-based instance
• Provision data pods to consumers

26. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Delphix Dynamic Data Platform and GDPR
Ease “Cross Border Transfer” restrictions using
pseudonymisation and anonymization
Protection of live production data
Satisfy “Right to Be Forgotten” requirements for non-
production
Breach notification support*
Secure personal data in both cloud and on-premises data
through pseudonymisation and anonymization
* though profiling can help to identify what information is lost

27. © 2017 Delphix. All Rights Reserved. Private and Confidential.
The Best Part
Self-Service Access to a Masked & Test Data Library
Production/Source Masking & Manipulation Project Data Library
Secure
Subset
Add
Synthetic
Collect production data
 Masking Factory
 Masked for purpose
 Audit & QA
 Refresh Re-Certify
Files
Databases
Secure and manipulate Provision, bookmark, store
Masked,
full copy
Prod +
Synth
10%
subset
5%
subset
Full copy
Prod +
Synth
 Centralised
 Controlled
 Secured
 Audited
 Personalised
 Version Controlled
 Instant Access
 No downtime refresh
RELPICATED SDD

28. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Benefits of Integrated Data Masking and Data Delivery
30
Provide
SELF SERVICE
Protect data
EVERYWHERE
your business operates
• Implement data masking in on-prem, cloud, or hybrid environments
• Broad support for multiple platforms, databases, and file systems
• Replicate and synchronise data to where you need it
• Automatically discover, protect, and audit sensitive data
• Mask once, then deliver secure data everywhere in just minutes
• Reduced storage requirements across your whole non-production estate
• Eliminate wait time for secure data
• Give data consumers self-service control to refresh, rewind, share, and branch data
• Maintain a single source or record for when, where, and how data is masked
Make data masking
EFFICIENT
for data consumers

29. © 2017 Delphix. All Rights Reserved. Private and Confidential.
Select Delphix Customers
31
Financial Healthcare TelecomManufacturingRetailTechnology

30. © 2017 Delphix. All Rights Reserved. Private and Confidential.
• Requirements to achieve compliance with GDPR
• Sensitive customer information hindered ability to share data
with offshore Infosys testing teams
• Complex, outsourced data operations slowed environment
provisioning for core business processes testing (e.g. order
to cash)
Case Study: Increasing testing agility
and ensuring GDPR compliance
SELF-SERVICE
data control for offshore
Infosys testing teams
GDPR COMPLIANCE
by masking EU citizens’
confidential data across
Oracle, SQL Server, z/OS
DATA DELIVERY IN
MINUTES
instead of two weeks
TOP 5 LOGISTICS
FIRM IN Europe
32

31. © 2017 Delphix. All Rights Reserved. Private and Confidential.
• Requirements to achieve compliance with GDPR
• Sensitive customer information hindered ability to deliver
data for QA teams
• Unable to identify and anonymize sensitive data across
incredibly complex and large SAP Applications, while
ensuring applications remain functional
Case Study: Ensuring GDPR
compliance of SAP Applications
SENSITIVE DATA
IDENTIFICATION
across 100,000+ SAP tables
using pre-built Delphix
Profiler in minutes
GDPR COMPLIANCE
by masking EU citizens’
confidential data across
SAP Applications
DATA DELIVERY IN
MINUTES
instead of weeks
TOP 5 IT SERVICE
FIRM IN Europe
33

32. © 2017 Delphix. All Rights Reserved. Private and Confidential.
QUESTIONS?
gary.hallam@delphix.com