Quick start: Protect data | IBM Cloud Pak for Data as a Service

Quick start: Protect data

You can protect data with Watson Knowledge Catalog by creating data protection rules that define the type of data to protect and the protection method. Data protection rules are enforced for assets in governed catalogs. Read about data protection rules, then watch a video and take a tutorial that’s suitable for users with some knowledge of data masking, but does not require coding.

Required service Watson Knowledge Catalog

Required permission You must have the Manage data protection rules permission that comes with any of the Watson Knowledge Catalog user roles.

Your basic workflow is to create a data protection rule. It goes into effect immediately after you create it.

Read about protecting data

You create data protection rules to identify the data to control and to specify the method of control. Within data protection rules, you can include classifications, data classes, business terms, or tags to identify the data to control. You can choose to deny access to data, to mask sensitive data values, or to filter rows.

Data masking helps you protect sensitive data, such as personally identifiable information or restricted business data to avoid the risk of compromising confidential information. It is defined in data protection rules that are enforced for an asset. Depending on the method of data masking, data is redacted, substituted, or obfuscated with retained formatting in the asset preview.

Watch a video about masking data

Watch Video Watch this video to see how to create data protection rules to mask data using different masking types.

This video provides a visual method as an alternative to following the written steps in this documentation.

Tip: Start the video, then as you scroll through the tutorial, the video moves to picture-in-picture mode. You can use picture-in-picture mode so you can follow the video as you complete the tasks in this tutorial. Click the timestamps for each task to follow along.

Try a tutorial to mask data

In this tutorial, you will complete these tasks:

Task 1: Add a data asset to your catalog.
Task 2: Create a data protection rule to obfuscate data.
Task 3: Create a data protection rule to redact data.
Task 4: Create a data protection rule to substitute data.
Task 5: View the masked data.

This tutorial will take approximately 20 minutes to complete.

Prerequisites

A previously created catalog with data polices enforced or access to create a catalog.

Task 1: Add the data set to your catalog

The data set you will use in this tutorial includes several columns with sensitive data. Follow these steps to add the data set to your catalog:

Access the Auto Insurance Customers data set in the Gallery.
Click the download icon, and save the file locally.
From the navigation menu, click Catalogs > View all catalogs.
Open your catalog, or create one if needed.
From the Assets page of a catalog, click Add to Catalog > Local files.
On the Add data assets from local files page, click browse, select the AutoInsuranceCustomers.csv from your computer, and click Open.
Click Add. Stay on the page until the load completes.
When the file loads, open the AutoInsuranceCustomers.csv data asset.
Click the Asset tab to preview the data.
Scroll to the right to see all of the columns in the data set.
Look at the National_ID, CreditCard_Number, and Marital_Status columns. These columns contain sensitive data that needs to be masked.

Check your progress

The following image shows the AutoInsuranceCustomers.csv file in the catalog.

Task 2: Create a data protection rule to obfuscate data

preview tutorial video To preview this task, watch the video beginning at 03:36.

The first data protection rule will obfuscate government identities such as US Social Security Number. Follow these steps to create a data protection rule to obfuscate data:

Click the Navigation Menu icon, and click Governance > Rules.
From the rules page, click Add rule > New rule. You will first create a data protection rule that obfuscates government identity data which hides the values of the data but preserves the format.
Select Data protection rule, and click Next.
In the New data protection rule page that opens, complete the basic fields.
In the Name section type Obfuscate government identity.
In the Business definition section type Rule to mask sensitive information.
For Condition 1, in the If field, select Data class.
In the Search for a data class field, type US Social Security Number, and select US Social Security Number from the list.
Click Add new condition.
Change And to Or.
For Condition 2, specify Data class and Canadian Social Insurance Number.
Click Add new condition.
For Condition 3, specify Data class and UK National Insurance Number.
For the Action, select mask columns.
For the in columns containing field, select Data class. The same three data classes previously selected are filled in for you.
For the masking method, select Obfuscate. You can hover over each masking option to see an example of masked data with the selected option.
Click Create.

Check your progress

The following image shows the obfuscate data protection rule.

Task 3: Create a data protection rule to redact data

The second rule will redact personal demographic information such as ethnicity. Follow these steps to create a data protection rule to redact data:

Tip: You will need the Watson Knowledge Catalog Standard or Professional plan to create more than one data protection rule.

From the rules page, click Add rule > New rule. You will next create a data protection rule that redacts personal demographic data which hides the value of the data by replacing it with ten X characters.
Select Data protection rule, and click Next.
In the New data protection rule page that opens, complete the basic fields.
In the Name section type Redact personal demographic information.
In the Business definition section type Rule to mask sensitive information.
For Condition 1, in the If field, select Data class.
In the Search for a data class field, type Religion, and select Religion from the list.
Click Add new condition.
Change And to Or.
For Condition 2, specify Data class and Ethnicity.
Click Add new condition.
For Condition 3, specify Data class and Legal Marital/Civil Status.
Click Add new condition.
For Condition 4, specify Data class and Political Party.
For the Action, select mask columns.
For the in columns containing field, select Data class. The same three data classes previously selected are filled in for you.
For the masking method, select Redact. You can hover over each masking option to see an example of masked data with the selected option.
Click Create.

Check your progress

The following image shows the redact data protection rule.

Task 4: Create a data protection rule to substitute data

The third rule will substitute financial account data such as credit card numbers.

Tip: You will need the Watson Knowledge Catalog Standard or Professional plan to create more than one data protection rule.

From the rules page, click Add rule > New rule. You will next create a data protection rule that substitutes data which hides the values of the data by replacing them with hash values.
From the rules page, click Add rule > New rule.
Select Data protection rule and click Next.
In the New data protection rule page that opens, complete the basic fields.
In the Name section type Substitute financial account data.
In the Business definition section type Rule to mask sensitive information.
For Condition 1, in the If field, select Data class.
In the Search for a data class field, type Credit Card Number, and select Credit Card Number from the list.
Click Add new condition.
Change And to Or.
For Condition 2, specify Data class and Account Number.
For the Action, select mask columns.
For the in columns containing field, select Data class. The same three data classes previously selected are filled in for you.
For the masking method, select Substitute. You can hover over each masking option to see an example of masked data with the selected option.
Click Create.

Check your progress

The following image shows the substitute data protection rule.

(Optional) Task 5: View the masked data

Watch Video Watch the video beginning at 02:28 to see the effect of masked columns in a data set.

Tip: If you are the owner of AutoInsuranceCustomers.csv, you must log in as a different user to view the masked data.

Now that the rules are in place, you view the masked data from the perspective of a different user.

From the navigation menu , click Catalogs > View all catalogs.
Select the catalog that contains the AutoInsuranceCustomers.csv data asset, and click AutoInsuranceCustomers.csv to view the asset.
Select the Asset tab to preview the data.
Horizontally scroll through the columns of data and move your mouse cursor over the Lock icons above each data column to view the data protection rule that is masking the data.

Check your progress

The following image shows the AutoInsuranceCustomers asset with masked columns.

Next steps

Now the data is ready to be used. For example, you or other users can do any of these tasks:

Additional resources

View more videos for catalog governance.
Find sample data sets to gain hands-on experience with protecting data assets in a catalog in the Gallery.

Parent topic: Quick start tutorials