Data Masking for Higher Education: A Case Study on Imperva Camouflage

The client is a leading online education services provider operating accredited Universities in the United States. The client has a mandate to maintain the highest standard of data security and ensure strong protection of their students’ data. They have taken a proactive stance by deploying a data masking software solution to dramatically reduce the risk of exposure of their student data. The client needed a software solution that could effectively protect student data while being time and resource-efficient. They also required a vendor with the right technology and domain expertise. The client's brand integrity was paramount, and they took their mandate of secure student data very seriously.

A leading online education services provider in the United States faced a significant challenge in protecting the Personally Identifiable Information (PII) of its students in non-production environments. These environments included application development, testing, and training, which required the use of student data. The challenge was to find a solution that could securely de-identify student information before sharing it for these purposes. The need for such a solution was driven not only by the priority of ensuring the security of student information but also by the need to comply with the Family Educational Rights and Protection Act (FERPA). The client was also under pressure to maintain the integrity of its brand and uphold a track record of secure student data. The ideal solution needed to be time and resource-efficient, support the complexity of their underlying data, and mask it intelligently so that the end result looks and acts like the original data. The client also sought a vendor with a strong consulting practice to leverage data masking experts and accelerate the project.

Imperva Camouflage was chosen to deliver a complete data masking solution. The solution exceeded the client’s expectations in terms of software functionality, deep domain expertise, and consulting services. A key turning point during the vendor evaluation was the discovery technology provided by Imperva Camouflage. The client used this feature to scan databases for in-scope data, pinpointing the exact locations where PII existed within non-production environments. This reduced the number of databases that required masking, saving the client significant time and resources. After locating databases containing PII, the client implemented data masking to the prescribed areas, effectively meeting the project’s tight time constraints. The client also outsourced ongoing maintenance and support to Imperva Camouflage. The specialists from Imperva Camouflage were engaged on a routine basis to maintain and update masking projects in response to any changes in the masking requirements or in the underlying database environment. This ongoing service was delivered remotely, increasing efficiency and reducing cost.

• The Imperva Camouflage solution successfully protected the student databases and identified the true sensitive data that needed to be masked. The solution also delivered data masking consulting services remotely. The discovery feature of Imperva Camouflage was used innovatively to create a custom change audit process, delivering higher quality and greater frequency data scans than alternatives. This resulted in a superior audit process that was faster, more efficient, and allowed for more frequent audits. The success of the installation prompted the client to look to Imperva Camouflage for a managed masking service on an ongoing basis. The client found a vendor with solid technology, a strong consulting practice, and ease of overall experience in Imperva Camouflage. The discovery feature emerged as a focal point in this solution by both dramatically decreasing the scope of data to be masked and innovatively enabling the creation of an automated change audit process. Data masking has been vital in the development of the client's strategy to ensure its brand integrity is upheld, risk management policies are in check, and student data is secured.

• Reduced the estimated masking effort by over 50% by quickly identifying only the databases containing sensitive data and eliminating from scope those that did not.
• Saved over $750,000 in time and resources as many of the databases initially thought to require data protection fell out of the high risk zone.
• Provided consistent masking across the in-scope databases while accommodating varying database structures and different database types.