SKB Bank automated the protection of client data when transferring database copies to developers

2021: Implementation of the system of search, classification and concealment of confidential information

On March 29, 2020, Jet Infosystems announced that its specialists had deployed a system for searching, classifying and masking confidential information in databases in SKB-Bank based on a JumbleDB solution from Infognito (formerly Brillix). With it, the credit institution protects customer data when transferring copies of databases from productive environments to developers.

Previously, SKB-Bank used the built-in tools of the used database management system to mask confidential information in databases transmitted to developers. However, the process was very time consuming and, depending on the size of the database, could last from several hours to several days. To speed up work and reduce labor costs for them, the bank decided to automate this process with the help of specialized software.

To install updates quickly, developers need copies of the databases that are used in the SOUNDenvironment. When transferring databases, it is important for us to be sure that they do not contain personal customer data and other business process critical information. The use of built-in DBMS tools makes the task of masking data labor-intensive and requires a team of specialists with deep knowledge in such systems. The tool we selected allows you to perform automated search, classification and masking of data without immersion in the specifics of the DBMS, which is extremely important in the eternal race to reduce time to market indicators, "said Denis Uleiko, director of the information security department of SKB Bank.

The implementation team consisted of integrator, credit institution and vendor experts. Specialists of "Jet Infosystems" together with administrators of the bank's database developed and configured rules for searching and classifying passport data according to regular expressions, and Infognito specialists created adaptive methods for searching and masking personal data taking into account their Russian specifics. For example, to detect INN and SNILS, the solution not only searches for numerical sequences of the required length, but also makes additional checks for compliance with checksums.

For the first time, we used Infognito's solution in data concealment projects, and developed all project documentation from scratch, building on the world's best database protection practices. The active interaction with the customer team and its high involvement in the project helped us reduce the number of false positives, and the ON vendor's readiness to quickly respond to product questions served as a great help in solving the difficulties that we encountered during the configuration of the solution. As a result, the customer managed to close all tasks within the project, and we acquired product competencies, "comments the Alexander Lopatin head of infrastructure security at information security the Infosystems Jet Center.

Using the implemented solution, SKB Bank provided automated search, classification and masking of data according to configured templates for Oracle databases used. In the future, the credit institution plans to expand the use of software to other databases.