How to Perform DataSunrise Static Data Masking for MongoDB

DataSunrise now has the capability of Static Data Masking for MongoDB. Earlier, only Dynamic Masking was supported. Now you can use all DataSunrise functionality with a variety of masking methods including Format-Preserving Encryption (FPE), Format-Preserving Tokenization (FPT), and Lua script to implement custom masking algorithms.

You can easily choose which fields should be masked and how. For embedded documents, all fields with a specified name will be masked. It ensures complete security when dealing with sensitive data, regardless of your security goals, such as corporate activities or giving access to databases to outsource and third-party IT companies.

DataSunrise supports Static Data Masking of validated documents only. Otherwise, an error will occur during the Static Masking process.

Granting Read and Write Permissions

To perform Static Data Masking on a MongoDB database, you need a database user with the corresponding permissions.

For the source database, execute:

use <Source_DB>
db.grantRolesToUser("<User_name>", ["read"])

For the target database, execute:

use <Target_DB>
db.grantRolesToUser("<User_name>", ["readWrite"])

Creating Instance for MongoDB

First, you need to create an Instance for MongoDB in DataSunrise. This is necessary to create a database profile. The beginning is the same for every database: just input connection details for your MongoDB.

Be sure to save your password in DataSunrise, CyberArk, or AWS Secrets Manager. Otherwise, if you do not save your password in an instance, it must be stored in a Static Masking task. The Static Masking process cannot be started without the saved password.

Press Test and after successful connection press Save.

Add New Static Data Masking Task

Open DataSunrise Web Console, Static Masking subsection, and click New to create a new Static Masking task.

In Source and Target Instances, select source and target database instances from the drop-down list and enter credentials for the database user.

Press the Select button and choose the required collection to use in the Static Data Masking process as source collection:

Press the Add Column button and enter the exact name of the field you want to mask:

Add all the required fields to mask:

If necessary, select the required field, click Set Masking Method and select a masking method for this particular column. Repeat for other columns as needed. All masking methods are available for MongoDB except for Function call.

Since this is a Periodic Static Masking Task you can choose the required frequency of the task’s execution.

Press Save.

Running Static Data Masking

Enter the newly created Static Data Masking task and press Start:

Customization of Static Data Masking Process

There are three main parameters to configure Static Data Masking for MongoDB:

• MongoDbDataSearchRecursionLimit – search nested depth limit for both Dynamic and Static Masking.
• StaticMaskingParallelLoadThreadsCount – number of threads used for parallel data transfer during Static Masking.
• MongoBulkOperationSize – data volume (number of documents) transferred by one bulk insert operation. The higher this parameter’s value, the quicker the insert operation, but the higher the memory consumption.

Conclusion

DataSunrise is a reliable supplier of MongoDB database protection solutions. Static Data Masking guarantees the comprehensive protection of sensitive data across your company together with other solutions such as Sensitive Data Discovery, Activity Monitoring, Database Firewall, and others.

Please note that In-Place Masking is not supported for MongoDB in the 8.0.0 release. As of 2024, static in-place masking is now fully supported. For more details, please refer to our updated article on this topic.

Keep your data safe with DataSunrise and follow our next updates to stay up to date.