If your database is tiny, has a simple data model and is well understood by current DBA’s – scripting “might” be the answer. However, the effort (and cost) to manually analyze and mask typical databases can get out of hand pretty quickly as requirements change, functionality is added and developers/DBA’s come and go.
While I’m not aware of any open source data masking products, there are commercial offerings available that are reasonably comprehensive, relatively easy to use and may be surprisingly reasonable cost-wise. Many of them include out-of-the-box discovery capability to identify and classify sensitive data (SSN, credit cards, phone numbers) as well as functionality to maintain the checksums, email address formatting, data grouping, etc. so that masked data looks and feels real.
But you don’t have to take my (admittedly biased) word for it. Ask the industry analysts such as Gartner or Forrester who have a number of unbiased reports available on masking that may help.
Hopefully these comments will encourage you to consider exploring commercial products as well as internal script development. At the end of the day, the most important thing is to protect the sensitive data that many of us see day-in and day-out that we really don’t need to see to do our jobs – putting us and the people whose personal data we hold at risk.
Senior Integration Specialist,
Camouflage Software Inc.