Cloud Data Security · Topic 3 of 7
Data Obfuscation, Tokenization and DLP
CCSP data obfuscation: static and dynamic masking, anonymization and pseudonymization, tokenization with a vault, and cloud DLP at rest, in motion, in use.
- 5 min
- Static masking makes a safe copy; dynamic masking hides at query time.
- Anonymization is irreversible; pseudonymization is reversible and still personal data.
- Tokens have no mathematical link to the original value; the vault holds the mapping.
What it is
Not every system needs the real data. Obfuscation hides sensitive values while keeping data usable, tokenization swaps them for meaningless substitutes, and data loss prevention (DLP) watches for sensitive data leaving where it should be.
Choosing the right one is a frequent exam theme: the question gives a use case and asks which technique fits it best.
How it works
Masking
Masking replaces values with realistic but fictitious ones, or hides part of a value.
| Type | How it works | Typical use |
|---|---|---|
| Static masking | A masked copy of the data set is created; the copy holds no real values | Test and development environments |
| Dynamic masking | Data is masked at query time based on the user's role; stored data stays real | Support staff seeing only the last four digits |
Common methods are substitution (realistic fake values), shuffling (moving values between records), nulling or deletion, and partial masking.
Anonymization and pseudonymization
Anonymization removes or alters identifiers so individuals can no longer be identified by any reasonably likely means. Truly anonymous data falls outside GDPR.
Pseudonymization replaces direct identifiers with a pseudonym, while the link to the real identity is kept separately. Under GDPR pseudonymized data is still personal data, because it can be re-identified with the extra information.
Removing names is often not enough. Combinations of indirect identifiers such as postcode, birth date and gender can single people out, so anonymization must treat them too, for example by generalizing or aggregating.
Tokenization
Tokenization replaces a sensitive value with a random token that has no mathematical relationship to the original. The mapping is held in a secured token vault.
| Feature | Tokenization | Encryption |
|---|---|---|
| Relation to original | None; random substitute | Mathematical, reversible with key |
| Reversal | Lookup in the vault | Decryption with the key |
| Format | Can preserve format and length | Format preserving modes exist but are less common |
| Compliance effect | Systems holding only tokens can fall out of PCI DSS scope | Systems holding ciphertext and able to decrypt stay in scope |
The token vault becomes the high value target. It is often run as a separate service or by a specialist provider, with strong isolation and monitoring.
Data loss prevention
DLP finds sensitive data using rules, patterns, fingerprints and classification labels, then enforces policy.
| Where | Example |
|---|---|
| At rest | Scanning storage buckets and SaaS repositories for unprotected card numbers |
| In motion | Inspecting email, web uploads and API traffic leaving the organization |
| In use | Endpoint agents blocking copy to USB or print of labelled files |
DLP components are discovery, monitoring and enforcement. Actions range from alerting, through encrypting or quarantining, to blocking.
Cloud challenges for DLP:
- Encrypted traffic must be inspected at a point where it is decrypted, such as a proxy or CASB, or through provider APIs.
- SaaS data is reached through APIs rather than network sensors.
- False positives frustrate users; policies need tuning with data owners.
- Running DLP inline adds latency and cost; scanning large stores takes time.
Choosing the technique
| Requirement | Best fit |
|---|---|
| Developers need realistic data without real customer details | Static masking |
| Call centre staff should see only part of a number | Dynamic masking |
| Researchers need statistics without identifying anyone | Anonymization |
| Payment system must store card references to reduce PCI scope | Tokenization |
| Data must be readable later by authorized systems | Encryption |
| Stop staff emailing customer lists outside the company | DLP |
A worked example
An online retailer wants to copy its production database to a cloud test environment and send purchase data to an analytics partner. Customer names, emails and card numbers are in scope.
For test, the architect applies static masking with substitution, so testers see realistic records and no real ones. Card numbers are already tokenized at checkout, so the database holds only tokens.
For the partner, data is aggregated and stripped of indirect identifiers. A DLP policy on outbound transfers flags any file containing unmasked card patterns.
How the exam asks about this
- "Which technique allows a payment system to reduce the number of components in PCI DSS scope?" Tokenization.
- "Test teams need data that looks real but contains no actual customer information. What should be used?" Static masking.
- "Under GDPR, is pseudonymized data personal data?" Yes, because it can be re-identified with additional information.
What to remember for the exam
- Static masking makes a safe copy; dynamic masking hides at query time.
- Anonymization is irreversible; pseudonymization is reversible and still personal data.
- Tokens have no mathematical link to the original value; the vault holds the mapping.
- DLP covers data at rest, in motion and in use, with discovery, monitoring and enforcement.
- Encrypted traffic must be decrypted somewhere for DLP to inspect it.
Removing direct identifiers is not anonymization if indirect identifiers remain. Combinations such as postcode, birth date and gender can re-identify individuals.
Common mistakes
Calling tokenization encryption. Tokens are random substitutes looked up in a vault, not ciphertext reversed with a key.
Using production data for testing. Copying live personal data into lower environments breaks least privilege and often privacy law; mask it first.
Expecting DLP to see everything. Without decryption points or API integration, DLP is blind to much cloud traffic.
Check yourself
What is the difference between static and dynamic masking?
Static masking creates a separate masked copy of the data, while dynamic masking leaves stored data intact and hides values as they are queried, based on the user.
Why can tokenization reduce PCI DSS scope?
Systems that store only tokens hold no cardholder data and cannot recover it, so they can be removed from scope; the token vault stays in scope.
What are the three states of data DLP can monitor?
Data at rest, data in motion and data in use.
Topic 3 of 7 in Cloud Data Security
Test yourself on Cloud Data Security
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.