Professional Data EngineerManaging and securing dataHard
A global e-commerce company uses BigQuery for its analytics platform. They have several datasets containing customer personal identifiable information (PII) that must be masked for analysts who do not have explicit permission to view raw PII. The company needs to implement a solution that dynamically masks sensitive columns without creating multiple copies of the data. How should you implement this data privacy requirement?
- AExport sensitive data to Cloud Storage and apply masking during export.
- BUse BigQuery authorized views with SELECT statements that perform hashing on sensitive columns.
- CImplement BigQuery column-level security with data masking policies.
- DCreate separate BigQuery tables with masked data for non-PII users.
Show answer & explanationAnswer & explanation
Correct answer: C. Implement BigQuery column-level security with data masking policies.
BigQuery column-level security with data masking policies allows dynamic masking of sensitive data at query time based on user permissions, without duplicating data or modifying the underlying tables.
Why the other options are wrong
- A. Exporting data to Cloud Storage and masking during export is a batch process, not dynamic, and creates data copies, failing to meet the 'without creating multiple copies' requirement.
- B. Using authorized views with hashing can work, but data masking policies offer a more robust, declarative, and centrally managed solution for dynamic masking without needing to write custom SQL for every view, supporting various masking functions (e.g., default masking, email masking, last four digits).
- D. Creating separate tables duplicates data and requires maintaining multiple versions, which is inefficient and error-prone.
BigQuery Data Masking
BigQuery data masking allows you to obscure sensitive data in a column, making it unreadable to unauthorized users while still allowing authorized users to see the original data. This is applied at query time based on policies.
- Part of BigQuery column-level security.
- Applies dynamic masking based on roles/permissions.
- No data duplication required.
- Supports various masking rules (e.g., default, email, number).
Memory trick: Masked data, quick and neat, BigQuery column-level can't be beat!