Mask data using Attribute-Based Access Control (ABAC)

[Will_Cho]

This article shows step-by-step of how to mask sensitive data such as PII (Personal Identifiable Information) in Pega application using Attribute-Based Access Control (ABAC) security model in Pega Platform. (For how to encrypt data using ABAC, read this article.)

===

Configurations

Step 1 - Optimize SSN property in the work class; i.e. expose the column in the DB table.

Step 2 - Create an Access Control Policy rule in the work class with Action=PropertyRead.

Step 3 - Create Access Control Policy Condition rule.

Step 4 - Create Access When rule.

a. Only [email protected] Operator ID can see the SSN value, which will be masked for other Operator IDs.

Step 5 - Run and verify the result.

a. Result 1 (UI)

When [email protected] opens the case, it’s masked.

Only [email protected] is permitted to see as configured in the access when rule.

b. Result 2 (data type table)

View from [email protected] (masked):

View from will.cho@pega (unmasked):

c. Result 3 (report definition)

View from [email protected] (masked):

View from [email protected] (unmasked):

= = =

In addition, the access control policy (Action=PropertyRead) works for an embedded property.

The following Table layout is sourced from pyWorkPage.MyList() pagelist property.

Here is the pagelist property definition.

The following access control policy rule is created in the data class used as a definition of the pagelist. We added .Name property for masking.

Please leave any question or feedback.

===

Other reference - How to “encrypt” sensitive data using Attribute-Based Access Control (ABAC) in Pega

[david.guzmana_cognizant (David Guzman)]

@Will Cho This article you’ve published is really helpful, thanks for that. Is there a way to mask the info using a custom Restriction Method for text rather than the three options Pega gives us (full maks, first ‘N’, last ‘N’)? For example, something like this:

NNNNNN******NNNN

[Will_Cho]

@david.guzmana@cognizant Thanks for your question. That is an interesting requirement. I don’t think I have seen that in my past projects. To my knowledge, in OOTB, Pega can only do one of the three options available.

[sangs1 (Sai Srinivas Sangewar)]

@Will ChoThanks for the article.

Below scenarios did not work well with masking, with the above set up:

1. When a Dpage source is used as look up for the data class on which the ACP is configured
2. When a Dpage source is a load activity which in turn invokes a Data set to fetch the results from the data class
3. When a data set which is configured on the same data class is run stand-alone

Would be interested to know if you have faced these situations and how you have handled it. Thank you

[Will_Cho]

@sangs1 i haven’t tried the pattern using Dpage.