Qualitative hochwertige Testdaten in der richtigen Größe und Zusammensetzung, zur richtigen Zeit am richtigen Ort steigern nachweislich die Anwendungsqualität, reduzieren die Fehlerrate im produktiven Betrieb, erhöhen die Agilität der Anwendungsentwicklung und sparen somit erhebliche Kosten. Aber welcher Entwickler oder Tester möchte in der Ausübung seines Berufes etwas eigentlich Verbotenes tun, wenn er mit personenbezogenen Daten in Berührung kommt? Daher bedarf es klarer Richtlinien und Standards in Kombination mit geeigneten Werkzeugen, um möglichen Verletzungen des Bundesdatenschutzgesetzes vorzubeugen.

1. www.informatik-aktuell.de

2. Wolfgang Epting:
Testdaten – versteckte Geschäftschance oder
immanentes Sicherheitsrisiko?

3. Missing Data
for Testing
Old, irrelevant
Test data
Missed Deadlines
Production Defects
Blown Budgets
Testing is 30-40% of
the Application
Development Cycle
Data Breach Risk
Testing Defects
8-12 Copies
of Production
Test Data Management: Testing Matters
Testing is not noticed when it goes well
Challenges and Costs

4. The Majority of Application Development Lifecycles are Spend on Development Tasks
Agile Development Needs Test Data Management

5. Agile Development Customer Challenges
4
Priority Challenge Cause
Delivery
Schedules
Delays, unreliable
schedules
Lengthy test data
provisioning processes
Application
Quality
Poor, High Error Rates Poor quality test data
Data Security Sensitive or private
information is exposed to
test teams, consultants and
outsourcers
Production data is
often used in test /
development
Budget Overruns Exceeding costs Resource intensive
manual test data
processes

6. Test Data is Not Immune
2010
2011
2012
2013
2014

7. Estimated Cost Examples for TDM
Based on interviews with Informatica partners and SMEs (1bil+ org)
6
Manual
Project Testers Iterations Hours Burdened
Labor
Test Total TDG Only
20 50 6 16 $150 $14,400,000 $1,440,000
Automated
Project Testers Iterations Hours Burdened
Labor
Test Total TDG Only
20 50 6 11.2 $150 $10,080,000 $1,008,000

8. Business Solution: Test Data Management (TDM)
• IT organizations need a solution that can speed testing
cycles by automatically creating and provisioning test
data with high precision; without introducing risk by
protecting sensitive and private information.
• Production data is analyzed for sensitive data and
then masked to ensure that data privacy is not
compromised in test systems. TDM eliminates the
need for full production copies by allowing testers to
create fully-functional data subsets at lower costs.
7
Secure and speed application
development times
Test Data
Generation
Test Data
Subset

9. Informatica Secure Testing
Solution Architecture
Dev
Test
Train
Informatica
Data Subset
Informatica Persistent
Data Masking
DISCOVER
Relationships
Keys
Sensitive Data
Synthetic Test Data
Informatica
Test Data Generation
Library of Test Data Sets
Informatica
Test Data
Management
Informatica
Test Data Warehouse
Self-Service Test
Data Provisioning
Informatica Test Tool
Integration
Custom
Apps
Production

10. 9
Purpose Built Solution Maximizes Productivity
Role Specific Tools, Task Specific Interfaces
Data
Governance
Define
Discover
Apply
Measure
and Monitor
Data Analysts
Auditors
Compliance Officers
Application Administrators
Compliance Officers
Business Analysts
Application Owners
& Administrators

11. Define Enterprise Masking Policies
Define Sensitive Data & Remediation Plan Data
Governance
Define
Discover
Apply
Measure
and
Monitor
• Standardize policies across the enterprise with
predefined packs for PII, PCI, and PHI
• Accelerate deployments with standard data
domains, element definitions and preferred masking
rules
Compliance, Privacy and
Security Officers
Business Analysts

12. Discover
Sensitive Data and Table Relationships Data
Governance
Define
Discover
Apply
Measure
and
Monitor
• Assess exposure by thoroughly identifying all
sensitive data
• Improve user productivity with automated
discovery-- predefined patterns, data domains,
Natural Language Processing, etc.
Data Analysts,
Architects
Auditors
Auto-learned Data Relationships and Model

13. Informatica Persistent Data Masking
Protect Sensitive Information in Nonproduction
Permanently alter sensitive data such as credit cards,
address information, or names
ID Name City Credit Card
Tampa
Hartford
Modesto
Plano0964
9388
2586
7310 Jeff Richards
Rob Davis
Mark Jones
John Smith
4198 9148 1499 1341
4298 0149 0134 0148
4981 4078 9149 1491
4417 1234 5678 9112
4198 9481 9147 0521
4298 9341 9544 9114
4981 1341 0854 0508
4417 9741 1949 9471
• Shuffle Employee ID’s
• Substitute Names
• Constant for City
• Special Credit Card Technique
Variety of Techniques:

14. BUKRS BELNR PERNR
RU 101 1
RU 102 2
RU 103 3
RU 104 4
PERNR
1
2
3
4
BUKRS BELNR PERNR
RU 101 221
RU 102 222
RU 103 223
RU 104 224
PERNR NACHN VORNA
1 Smith Jeff
2 Jones Mike
3 Washington Tina
4 Jenkins Janet
PERNR
1
2
3
4
PERNR NACHN VORNA
221 Smith Jeff
222 Jones Mike
223 Washington Tina
224 Jenkins Janet
PERNR SUBTY OBJPS
1 - 30
2 - 31
3 - 32
4 - 33
PERNR
1
2
3
4
PERNR SUBTY OBJPS
221 - 30
222 - 31
223 - 32
224 - 33
Data Masking – Cascade
Masked values cascade to all related
tables and fields
1. Process main table and create cross-
reference
2. Cascade changes to child tables
3. Cascade changes to related tables
4. Cascade changes to cluster database
tables (mainly HR)
PA0003 (payroll status)
PA0002 (personal data)
RELID SRTFD CLUSTD
RU 0000000500001 3611
RU 0000000500002 3245
RU 0000000500003 3176
RU 0000000500004 3594
PCL2 (HR Cluster 2) BSEG (Accounting Line Item)
CLUSTD
3611
3245
3176
3594
C
a
s
c
a
d
e

15. Application
Administrator
Create
Environments
as Needed
Universal Connectivity
Test Data Management
Execute Masking and Subset Jobs
Original
Source
Masked and
Subsetted Target
Etc.

16. Audit Data Masking Results
• Set up independent masking
validation rules
• Complete the audit process by
proving that sensitive
values have changed
• Ensure that formats are preserved
• Validate that data comes from a
dictionary of values
• Validate that no original values
exist in the masked database

17. 16
Getting Good Data to Test
Test Data Generation
• 1
6
Test Data
Generation
New
Functionality
PROD Data not
Representative
No Access to
PROD
• New tables related to the
functionality have no data in
production
• Data needs to be generated and
related to existing PROD data
• Existing capabilities rolled out to
new markets
• Data specific to new markets
needs to be generated and
related to existing PROD data
• Access to production is
limited by IT policies

18. Without Test Data Warehouse
• Need to avoid collisions amongst teams
• Provision full database copies per team
(virtual or physical)
• Refresh full databases to reset a small
amount of data
• No ability to have metadata descriptions
attached to test data sets
17
Product_id Product Name
P1 Benz
P2 BMW
P3 Toyota
P4 Ford
P5 GM
P6 VW
P7 Audi
Order_ID Order_Status
O1 Shipped
O2 In-Process
O3 Shipped
O4 Open
O5 In-Process
O6 Cancelled
O99 Shipped
Order_
Line_ID Order_ID Product_Id
OL1 O1 P1
OL2 O2 P2
OL3 O3 P3
OL4 O4 P1
OL5 O5 P7
Full Data Set
(Masked)
Test
Team
One
• Identify Data Set
• Run Tests
• Update/Insert Data
• Record Results
• Request Database Refresh

19. With Test Data Warehouse
18
Product_id Product Name
P1 Benz
P2 BMW
P3 Toyota
P4 Ford
P5 GM
P6 VW
P7 Audi
Order_ID Order_Status
O1 Shipped
O2 In-Process
O3 Shipped
O4 Open
O5 In-Process
O6 Cancelled
O99 Delivered
Order_
Line_ID Order_ID Product_Id
OL1 O1 P1
OL2 O2 P2
OL3 O3 P3
OL4 O4 P1
OL5 O5 P7
Full Data Set
(Masked)
Test
Team
One
Test
Team
Two
• Identify Version
• Run Tests
• No Updates
• Record Results
• Test Data Reset
- quarterly
• Identify Data Sets
• Run Tests
• Update/Insert
Data
• Record Results
• Test Data Reset -
weekly

21. Informatica Secure Testing Platform
Production
Test Data Management
Non-Production
Testers
Developers
Trainers
Risk &
Compliance
Officers
DBA &
Infrastructure
Managers
HP ALM
Test Tool
Integration
Persistent Data
Masking
Test Data Subset
Test Data
Generation
Sensitive Data
Discovery
Test Data
Warehouse
UAT
Train
Test
Dev
Cloud
Offshore,
Outsourced
Dynamic Data
Masking

22. TDM Factory Design
Importance of Repeatable Processes
TDM Factory
• Create your process
• Define your masking rules
• Define your subset templates
• Test on a subset of the data
• Test to ensure that your processes work as you
build them
• Continually improve the process based on the
feedback
Finished Goods
Holistic, Timely
Authoritative, Secure
Application Data
Raw Material
Data Masking and Data Subset is Not a Once-and-Done Project

23. Data Masking On Hadoop v9.7 Use Cases
(1) Persistent masking during
import process:
a) For Structured Data
b) For Semi-structured Data
(2) Persistent masking
of sensitive data in
Hadoop:
a) For Analytics
b) Data Provisioning
c) Test Data
(3) Dynamic
masking of sensitive
data in Hadoop
based on user role.
(4) Persistent masking during export
process:
a) For Structured Data
b) For Semi-structured Data

24. • Masks existing SFDC sandbox
environments
• Ensures data privacy
• Populate empty sandboxes
• Out of the box data masking
rules
• Minimal options for speed of
deployment
• Create test data sets for
sandboxes
• Rationalize existing SFDC
investment
23
Secure and Populate Sandbox Copies
Data Masking and Subset for salesforce.com

25. Insurance company complies with GDV Code of
Conduct mandate to protect insured sensitive data
THE CHALLENGE INFORMATICA
ADVANTAGE
RESULTS/BENEFITS
• Compliance with German Code
of Conduct for PII, PHI and
banking information
• Compliance to be achieved by
January 2016
• Multiple systems to be
protected including SAP and
Mainframe integrations
• Out-of-the-box data masking packs
to be applied in both SAP and
mainframe environment
• Consistently mask sensitive data
across multiple applications.
• Ability to handle complexity in data
models (SAP ~200.000 tables)
• Connectivity to all required data
sources including Oracle, DB2,
VSAM and IMS
• Comply with GDV Code of Conduct
12 months prior to deadline
• Consistently, reliably, and quickly
mask sensitive data
• Create a consistent test
environment with multiple systems
(SAP and Mainframe)
• Go live with complete scope in 9
months
KEY BUSINESS IMPERATIVE AND IT INITIATIVE
Business Imperative: Guarantee Security and Privacy are taken into
account in the design and processing of products and services
IT Initiative: Test Data Management for Secure Test Environments

26. • Test data that was available
in 10 days is now available
instantaneously
• Saved $2.2M with first
application
• Went live in 5 months
• Works across all applications
• Integrated data masking
• Ability to handle complexity
• Enabled consistent and
repeatable test data sets
Business Imperative: Enable testing teams across the globe
to self provision test data securely and on-demand
IT Initiative: Enterprise Test Data Management Platform and
Center of Excellence
KEY BUSINESS IMPERATIVE AND IT INITIATIVE
INFORMATICA ADVANTAGE RESULTS/BENEFITS
• Global team of 700+ testers
including employees,
contractors and consultants
need test data faster
• Need to adhere to strict data
privacy regulations
• Needed a platform that would
work across integrated new
and legacy applications
THE CHALLENGE
Global Team of 700 Testers Benefit
from Instantaneous Quality Test Data

27. Questions

28. 27