Professional Cloud Security EngineerEnsuring data protectionMedium
A global e-commerce company uses BigQuery to analyze customer purchasing patterns. They need to implement a solution that redacts or masks sensitive customer information (such as credit card numbers or personal identifying information) when viewed by analysts, but allows authorized personnel to see the original data for specific compliance audits. Which BigQuery security feature should they configure?
- AData Loss Prevention (DLP) API for BigQuery
- BBigQuery column-level security with data masking
- CBigQuery row-level security
- DAuthorized views with data transformation
Show answer & explanationAnswer & explanation
Correct answer: B. BigQuery column-level security with data masking
BigQuery column-level security with data masking allows sensitive data within specific columns to be obfuscated for most users, while still permitting full access to raw data for authorized roles, precisely matching the requirement.
Why the other options are wrong
- A. DLP API is primarily for identifying and redacting sensitive data before it's stored or for scanning existing data; it doesn't provide dynamic masking based on BigQuery user roles for data already in BigQuery.
- C. Row-level security restricts access to entire rows based on conditions, not specific data within columns.
- D. Authorized views can restrict access to certain columns or rows, but data transformation in views would permanently alter the data for all users of that view, not just mask it based on permissions.
BigQuery Column-level Security with Data Masking
This feature allows you to define policies that mask or redact data in specific columns for users who do not have appropriate permissions, while enabling authorized users to see the original, unmasked data.
- Controls access to data within columns.
- Masks data dynamically based on user roles.
- Original data remains intact for authorized access.
Memory trick: Columns Mask Sensitive Data for Specific Roles.