{"id":16781,"date":"2024-01-04T17:29:49","date_gmt":"2024-01-04T22:29:49","guid":{"rendered":"https:\/\/www.iri.com\/blog\/?p=16781"},"modified":"2024-01-05T15:14:19","modified_gmt":"2024-01-05T20:14:19","slug":"finding-and-masking-nosql-dbs-with-the-darkshield-gui","status":"publish","type":"post","link":"https:\/\/beta.iri.com\/blog\/data-protection\/finding-and-masking-nosql-dbs-with-the-darkshield-gui\/","title":{"rendered":"Masking NoSQL DB PII in the DarkShield GUI"},"content":{"rendered":"

This is the second article in a series of articles on using <\/span><\/i>IRI DarkShield<\/span><\/i><\/a> to search and mask sensitive data in NoSQL databases.<\/span><\/i><\/p>\n

Introduction<\/b><\/h5>\n

The <\/span>IRI DarkShield<\/span><\/a> data masking product now includes fit-for-purpose wizards in the <\/span>IRI Workbench<\/span><\/a> IDE to search (classify) and mask (remediate) PII or other sensitive \u201ddark data\u201d (as defined by Gartner) in structured, semi-structured, and unstructured file, NoSQL, and relational database sources.\u00a0<\/span><\/p>\n

This article covers the use of Workbench for finding and masking data in Cassandra, Elasticsearch, and MongoDB. The DarkShield API can support additional NoSQL databases as long as custom calling programs are provided, as shown in <\/span>this<\/span><\/a> repository.<\/span><\/p>\n

The diagram below summarizes DarkShield\u2019s architecture as part of the overarching Voracity data management platform. The wizard this article explains is inside Workbench:<\/span><\/p>\n

\"\"<\/p>\n

Although not discussed in this article, DarkShield also includes wizards for other sources, like: the <\/span>New File Search\/Masking Job<\/span><\/i><\/a> \u2026 <\/span><\/i>wizard for sensitive data in files, and the <\/span>New Relational DB Search\/Masking Job \u2026<\/span><\/i><\/a> wizard for sensitive data that is either semi-structured or unstructured in RDB columns.\u00a0<\/span><\/p>\n

What the DarkShield NoSQL DB Wizard Does<\/b><\/h5>\n

The \u201c<\/span>New NoSQL DB Search\/Masking Job \u2026<\/span><\/i>\u201d wizard in the IRI Workbench <\/span>GUI for DarkShield<\/span><\/a> helps you create a DarkShield Job to find and mask PII or other sensitive information in MongoDB, Cassandra and Elasticsearch. The job serializes into an XML \u201c.dsc\u201d file containing the Search and Mask Contexts applicable to your jobs.\u00a0<\/span><\/p>\n

Search Contexts contain instructions on how to access the NoSQL source silo and scan it for PII. Mask Contexts contain instructions for de-identifying the PII found during the search operations, and how to access the NoSQL target silo where the masked version of data will be sent.<\/span><\/p>\n

The scanning and remediation of data stored in NoSQL silos is based on your defined <\/span>Data Classes<\/span><\/a>, which are stored in an <\/span>IRI Data Class and Rule Library<\/span><\/i>. Each Data Class contains one or more search methods called Search Matchers used to identify PII.\u00a0\u00a0<\/span><\/p>\n

Previous iterations of the wizard only supported scanning and extracting sensitive values that matched Java RegEx patterns and Set File lookups. Today\u2019s wizard supports more search methods, and of course simultaneous or separate masking operations.\u00a0<\/span><\/p>\n

For more information on the various search methods available, read about <\/span>Data Matchers<\/span><\/a> and <\/span>Location Matchers<\/span><\/a>.<\/span><\/p>\n

Prerequisites<\/b>
\n<\/b><\/b><\/h5>\n

Before running the DarkShield NoSQL wizard, these preliminary steps must be completed:<\/span><\/p>\n

First, verify that the DarkShield API distribution directory has been specified in IRI Preferences. To do so go to <\/span>IRI Workbench \"\"<\/span><\/i> Preferences > IRI > DarkShield.<\/span><\/i> From here, you can configure both DarkShield GUI and API preferences including the host, port, and directory where the DarkShield API resides.<\/span><\/p>\n

\"\"<\/p>\n

Second, all DarkShield wizards require a project possessing an IRI Data Class and Rule Library. The IRI Library in turn should contain at least one Data Class and a masking Rule assigned to that Data Class. To learn about the IRI Data Class and Rule Library and how to create Data Classes and Rules, read this <\/span>article<\/span><\/a>.<\/span><\/p>\n

\"\"<\/p>\n

IRI Project containing IRI Library<\/span><\/i><\/p>\n

\"\"<\/p>\n

IRI Data Class and Rules Library Form Editor contains some Data Classes and Rules<\/span><\/i><\/p>\n

Third, verify that the Plankton (DarkShield API) server is running. This can be done by opening the DarkShield API Status view in IRI Workbench. This view displays information about the DarkShield API, including whether it is currently running.<\/span><\/p>\n

\"\"<\/p>\n

DarkShield API Status view panel<\/span><\/i><\/p>\n

Finally, ensure that the data silos you will be reading from and writing to can be accessed by the DarkShield application (DarkShield API). Each NoSQL database type (Cassandra, Elasticsearch, MongoDB, etc\u2026) uses a different SDK to connect and make CRUD operations with that particular NoSQL database type. As such, different database types may require different credentials and specifications for accessing and manipulating data in NoSQL silos.<\/span><\/p>\n

For my demonstration in this article, I have a MongoDB database called \u201cDarkshield\u201d with a collection called \u201cdata\u201d.<\/span><\/p>\n

\"\"<\/p>\n

View of data collection from MongoDB Compass<\/span><\/i><\/p>\n

<\/b>Using the Wizard<\/b>
\n<\/b><\/b><\/h5>\n

In this article, I will demonstrate the use of the <\/span>New NoSQL DB Search\/Masking Job<\/span><\/i>\u2026 wizard to create a DarkShield NoSQL Job.<\/span><\/p>\n

\"\"<\/p>\n

Launch the wizard from the<\/span> DarkShield menu <\/span>by selecting <\/span>New NoSQL DB\u00a0 Search\/Masking Job<\/span><\/i>\u2026. This opens the first page where you name a new job:<\/span><\/p>\n

\"\"<\/p>\n

Specify the folder and file name for the output of the wizard (your .dsc job configuration file).<\/span><\/p>\n

Click <\/span>Next<\/span><\/i> when finished to move on to the specifics of the data you are trying to find \u2014 and how it should be masked.<\/span><\/p>\n

\"\"<\/p>\n

Here is where you specify the IRI Data Class and Rule Library which contains your Data Classes, Data Class Groups, and (masking) Rules. It is possible to filter the Data Classes and Groups from the library we intend to use by selecting or deselecting Data Classes in the <\/span>Active<\/span><\/i> column. In this example, I am using the default Data Classes provided when creating an IRI Project.<\/span><\/p>\n

\"\"<\/p>\n

In the Masking Rules tab, we can see that two functions are available: a Format Preserving Encryption Rule and a Blur Date Rule. These rules dictate how PII found using Data Classes will be masked. It is also possible to add or remove Masking Rules from this tab.<\/span><\/p>\n

Click <\/span>Next<\/span><\/i> when finished to move onto the page that will allow you to assign these Masking Rules to specific Data Classes.<\/span><\/p>\n

\"\"<\/p>\n

On the <\/span>Assign Masking Rules to Data Classes<\/span><\/i> wizard page, each Data Class and Data Class Group must be assigned a Masking Rule to indicate how PII will be masked. If you do not wish to mask a particular PII data type, click <\/span>Back <\/span><\/i>and deselect the applicable Active checkbox in the Data Class or Data Class Group tab. Then return to this page and finish assigning rules to your data classes.<\/span><\/p>\n

Once finished, click <\/span>Next<\/span><\/i> to begin specifying the NoSQL silo that will be searched and masked.<\/span><\/p>\n

\"\"<\/p>\n

From this page, you are prompted to specify the NoSQL database type and a connection registry for the data source.<\/span><\/p>\n

Currently, the IRI Workbench GUI IRI DarkShield supports the following NoSQL database types:<\/span><\/p>\n