Difference between TDE/VPD/Data Masking/OLS - Oralce

Question

I've come across many kinds of data masking techniques used in Oracle database.. some are licensed some are included in enterprise edition itself.. leaving the licenses thing behind as it is restricted to ask about it here..

I would like to know what is the difference between

Transparent Data Encryption

Virtual Private Database

Oracle Label Security

Data Masking pack

Oracle Vault

Ultimately each one of the above does the same job - mask the data right?

What are the differences between them??

If data masking pretty much only overwrites the data which I actually need to mask, won't a simple SQL update statement do that trick on a particular table? Why buy a tool for that?

Thanks!

Answer 1

Actually they don't do the same.

TDE encrypts the data in the database, you need to configure the wallet and have it open before you can see/use the data after that.

VPD is an Access Control Mechanism, it allows you to define sub-datasets that will be owned by different users, allowing them to see/use only the data that they actually own (even if the same set of tables are shared among different VPDs)

To have more detailed information about each tool, please review the documentation on https://docs.oracle.com/en/database/

Answer 2

Fundamentally, all of these except Data Masking provide security for the original data. With the correct privileges, you can access the original sensitive information.

Data Masking Pack will OVERWRITE data that you designate as sensitive and for which you create masks. The original data is lost. e.g "John" might be replaced with "James". This is so that you can take a copy of production data, anonymize it, and then use it in non-secure environments such as testing, development, etc.