Topaz Workbench File-AID Data Privacy User Guide

Transcription

1 Topaz Workbench File-AID Data Privacy User Guide

2 Table of Contents Welcome to File-AID Data Privacy Welcome to File-AID Data Privacy About this Guide Who Should Read This Guide Getting Started with File-AID Data Privacy Getting Started with File-AID Data Privacy Basic Setup Working with a Project Creating Credentials and Translate Tables Managing Repository Content Managing Projects Data Privacy Views Data Privacy Views Data Privacy Explorer View Data Privacy Menu - Stack Bars Data Privacy Repositories Global Project Definitions Global Definitions Importing Global Data Elements and Rules Updates to Global Data Elements and Rules Importing Composites Data Privacy Projects Data Privacy Projects Create a New Data Privacy Project Project Overview Rename a Data Privacy Project Delete a Data Privacy Project Manage Data Elements Manage Data Elements... 29

3 Create a New Data Element Edit a Data Element Data Element Processing Types Data Element Processing Types Data Element - Text Processing Type Data Element - Numeric Processing Type Number of Digits Decimal Positions Data Element - Date Processing Type Data Element - Custom Processing Type Value Alignment Invalid and Long Data Values Invalid Source Value Invalid Disguised Value Long Data Values Null Value Handling Data Element References Rename a Data Element Delete a Data Element Import a Global Data Element Disable a Data Element Data Element Source Data Identifiers Data Element Source Data Identifiers Create a New Source Data Identifier Create a New Source Data Identifier from Metadata Source Data Identifier - Name and Fields View Source Data Identifier - Restrictions View (NONE) Source Data Identifier - Restrictions View (DBMS) Source Data Identifier - Restrictions View (LAYOUT) Source Data Identifier - Text Processing Options Source Data Identifier - Number Processing Options... 46

4 Source Data Identifier - Date Processing Options Source Data Identifier - Custom Processing Options Data Element - Multi-field Source Data Identifiers Import Data Elements from a File Import Data Elements from a File Manage Project Rules Manage Rules Rules Best Practice Rule List Rule Ordering Button Disable/Enable Rule Button Create a New Rule Rename a Data Privacy Rule Delete a Data Privacy Rule Disable a Data Privacy Rule Import a Global Rule Field Mask Processing Field Mask Processing Processing Types Masking within Rules Manage Rule Actions Data Privacy Rule Actions Rule Action Types Format-Preserving Encryption Translation Format Preserving Encryption Format Preserving Encryption Rule Actions Translation Rule Actions Translation Rule Actions Translation Rule Actions - Search for Source Value Access Path Related Topics... 62

5 Translation Rule Actions - Hash Source Value Access Path Related Topics Translation Rule Actions - Unique Value Access Path Related Topics Translation Rule Actions - Random Access Path Related Topics Translation Rule Actions - Sequential Access Path Related Topics Translation Rule Actions - Two-tier Access Path Hash Source Value Tier-two Access Sequential Row Selection Tier-two Access Random Row Selection Tier-two Access Related Topics Composite Rule Actions Overloaded Rule Actions Manage Rule Variables Rule Variables File-AID/Data Solutions Variable Behavior File-AID/RDX Variable Behavior Create a New Rule Variable Manage Rule Logic Rule Logic Expression Builder Expression Builder Editing Features Expression Builder Tabs Logic Tab Functions Tab Resources Tab Condition Statements Expression Builder Operators Operators... 77

6 Selection Criteria Operators Expression Builder Functions Expression Builder Functions String Functions Date Functions Data Privacy Functions Normalization Functions Flow Control Functions Custom Functions ADD_DAYS Function ADD_MONTHS Function ADD_YEARS Function ADJUST_CASE Function ALPHA_NUM_IN Function ALPHA_NUM_OUT Function APPLY_MASK Function APPLY_MASK_NUMERIC Function CCN_FIND_IN Function CCN_FIND_OUT Function CCN_IN Function CCN_OUT Function CCN_TYPE Function CD_AU_ABN Function CD_AU_ACN Function CD_AU_TFN Function CD_CA_SIN Function CD_CH_RUT Function CD_CN_ID Function CD_IBAN Function CD_MOD10_LUHN Function CD_MOD11 Function... 93

7 COMPARE_STRING Function COMPRESS Function CURRENT_DATE Function DATE2STR Function FIND_PATTERN Function FIND_STRING Function FIND_WORD Function FOUND_STRING Function FOUND_WORD Function GET_DAY Function GET_MONTH Function GET_WEEKDAY Function GET_YEAR Function ID_AU_IN Function ID_AU_OUT Function ID_AU_TYPE Function ID_CA_IN Function ID_CA_OUT Function INTL_PHONE_IN Function INTL_PHONE_OUT Function IS_ACCESS_PATH_FAILED Function IS_ALPHA Function IS_COMPOSITE_FAILED Function IS_IBAN Function IS_NUMERIC Function LEFT Function LEFT_TRIM Function LENGTH Function LOG Function LOWER_CASE Function MATCHES_PATTERN Function

8 NUM2STR Function PAD_LEFT Function PAD_RIGHT Function PHONE_IN Function PHONE_OUT Function PRECISION Function PROPER_CASE Function REPLACE_ALL Function REPLACE_FIRST Function RIGHT Function RIGHT_TRIM Function SCALE Function SET_DAY Function SET_MONTH Function SET_YEAR Function SKIP_RECORD Function SSN_FIND_IN Function SSN_FIND_OUT Function SSN_IN Function SSN_OUT Function STR2DATE Function STR2NUM Function SUBSTITUTE Function SUBSTRING1 Function SUBSTRING2 Function TERMINATE_EXECUTION Function TRIM Function UPPER_CASE Function Create a New Expression with the Expression Builder Manage Metadata Coverage Manage Metadata

9 Add Project Metadata Remove Project Metadata Coverage Display Coverage Conflicts Coverage for REDEFINES Column Chooser Manage Composite Definitions Create a New Composite Definition Create a New Data Item Category Create a New Composite Data Item Import a Global Composite Definition Import a Global Composite Data Item Import a Global Composite Data Item Category Export a Composite Definition Import a Composite Definition Manage Metadata Extensions Manage Metadata Extensions Create a New Metadata Extension Edit a Metadata Extension Delete a Metadata Extension Manage Execution Parameters Manage Execution Parameters Create a New Execution Parameter Delete an Execution Parameter Export Execution Parameters Import Execution Parameters Data Disguise in Other File-AID Products Data Disguise in Other File-AID Products Imbedded Privacy Rules Dynamic Privacy Rules Results

10 Data Disguise in File-AID/Data Solutions Data Disguise in File-AID for DB Data Disguise in File-AID for IMS Data Disguise in File-AID/RDX Data Disguise in File-AID/EX File Support Configure Data Privacy Java Detail Log Detail and Execution Logs File-AID/EX File-AID Mainframe Products Execution Log Java Detail Log Resource Administration Resource Administration Manage Encryption Keys Manage Encryption Keys Define Encryption Key Wizard Encryption Key Source Encryption Key - Project Availability Manage Translate Tables Manage Translate Tables Create a New Translate Table Translate Table Source Translate Table Field Mapping Translate Table Access Path Translate Table Access Path Search for Source Value Access Path Create Search for Source Value Access Path Definition Related Topics Hash Source Value Access Path

11 Create Hash Source Value Access Path Definition Related Topics Unique Value Access Path Create Unique Value Access Path Definition Related Topics Random Access Path Create Random Access Path Definition Related Topics Sequential Access Path Create Sequential Access Path Definition Related Topics Two-tier Access Path Create Two-tier Access Path Definition Related Topics Translate Table Access Path Failed Translate Table Project Availability Translate Table References Dynamic Data Items Manage Data Privacy Repositories Manage Data Privacy Repositories Working with Repositories Add a New Repository Edit an Existing Repository Connect to an Existing Repository Disconnect from Existing Repository Migrate Repository Delete an Existing Derby Repository Database Manage Credentials Manage Credentials Create New Credentials Manage Custom Functions

12 Manage Custom Functions Create a New Custom Function Create a New Java Routine Reports File-AID Data Privacy Reports Coverage Analysis Report Coverage Analysis Report Run and View Coverage Analysis Report Certificate Management Utility Installing Your Own Certificate Adjusting the Existing Certificate Summary Reports Manage Security Manage Security Data Privacy Administrator Data Privacy Auditor Data Privacy Global Resource Administrator Data Privacy Project Administrator Data Privacy SME (Subject Matter Expert) Map Security Roles Configure Security Role Authorizations Conflict Detection and Resolution Conflict Detection and Resolution Conflict Example Conflict Detection and Resolution Messages Conflict Detection Messages Conflict Resolution Messages Update Repository Utility Directly Updating the Data Privacy Repository Find/Replace

13 Batch Import Utility Batch Import Utility Data Privacy API Create a New Custom Function to Apply Privacy Rules Create a New Standalone Java Program to Apply Data Privacy Rules Source Data Identifier Overrides Overriding Source Data Identifiers During Execution Override File Format XML Elements and Attributes JSON File Format XML Example JSON Example Index

14 Welcome to File-AID Data Privacy Welcome to File-AID Data Privacy Compuware's File-AID Data Privacy plug-in for Topaz Workbench allows you to address many of your data privacy needs whether you have files or databases on distributed machines or on a mainframe computer. You can protect your data by concealing sensitive information while maintaining data integrity, table relationships, and data format during processing. For example, a female employee name can be replaced by a recognizable fictitious female name or a nonsensical set of characters. Data privacy rules are created in the Data Privacy plug-in and stored in a repository. These rules are then available to disguise data from each of the following File-AID products: File-AID/EX File-AID/Data Solutions File-AID for DB2 File-AID/RDX File-AID for IMS The data to be disguised may reside in z/os files, IMS databases, or relational database tables in DB2, DB2 UDB, Microsoft SQL Server, Sybase, or Oracle. With Data Privacy you can: Build rules to disguise data for a defined collection of fields. Apply data encryption to fields for the supported data types. Replace field values with consistent valid data via key encryption (using an encoding key value). Age dates by adding to or subtracting from the date or replacing the date with a specific date. Use translate tables to replace field values. Translate tables substitute data from an external database for the information in the database to be disguised. Use value conversion functions (user-written code) to normalize data to be disguised according to the specified data element and then return disguised data back to the original format. A number of features make Data Privacy easier to use: A Data Privacy Explorer provides an easy method for accessing a project. A Data Privacy project contains all of the components that you use to disguise data: data elements, source data identifiers, translate tables, encoding keys, metadata, rules, etc. For more information, see Create a New Data Privacy Project. Metadata can be imported into your project from COBOL or PL/I layouts on the mainframe or from Oracle, SQL Server, or DB2 tables or schemas on a workstation. Data elements provide a sharable definition of the type of a data field, or of several data fields, that have special conceptual meaning for the user and that the user may intend to use in defining Data Privacy Rules. Data elements can be created for use globally or for a single project. Global

15 data elements can be used in multiple projects through the import process. For more information, see Create a New Data Element. Source data Identifiers specify what data will be identified as a specified data element and the action to take (include or exclude) when source data fields match this identifier. For more information, see Data Element Source Data Identifiers. A Rules Repository contains global and/or project-specific data elements and rules. Global data elements and rules are made available for multiple projects while project data elements and rules are available only for the project for which they were created. Other File-AID products can use dynamic privacy rules that you created within File-AID Data Privacy in Topaz Workbench. This means that you can use Topaz Workbench to create rules that can be used outside of Topaz Workbench. The Data Privacy Menu contains stack bars, each of which contains a list of tasks, logically grouped, that you can perform: Resource Administration options: o o o o o Manage Encryption Keys Manage Translate Tables Manage Data Privacy Repositories Manage Credentials Manage Custom Functions Reports option: o o Coverage Analysis Report In addition to the reports listed in this stack bar, a project summary is available by rightclicking the project name in the Data Privacy Explorer view and selecting View Project Summary. In addition to the project summary, you access a data elements summary and a rules summary by clicking Summary from their respective tabs. About this Guide This guide provides the information needed to use File-AID Data Privacy to disguise your data. It consists of the following chapters: Welcome to File-AID Data Privacy Getting Started with File-AID Data Privacy Data Privacy Projects Manage Data Elements Manage Project Rules Manage Metadata Coverage

16 Manage Composite Definitions Manage Metadata Extensions Data Disguise in Other File-AID Products Resource Administration Reports Manage Security Conflict Detection and Resolution Update Repository Utility Batch Import Utility Data Privacy API Who Should Read This Guide This guide is written for the end user who will be using File-AID Data Privacy. This guide assumes that you are already familiar with the Windows operating system. If you need additional information on Windows, there are many helpful books available for your review.

17 Getting Started with File-AID Data Privacy Getting Started with File-AID Data Privacy File-AID Data Privacy can be accessed from Topaz Workbench, which is Eclipse based, allowing you to access data on the mainframe and database management systems (DBMS) from your PC or workstation. Before you can work with the data privacy application you must perform basic setup. To use translate tables, the translate tables must be created and appropriate credentials assigned. To use dynamic privacy rules with Compuware's File-AID products, you must create a project with its associated data elements and project rules. Basic Setup The basic setup steps only need to be performed when you first install the Topaz Workbench or if your working environment changes. 1. Start the Topaz Workbench. 2. Set up File-AID Services: Note: To use Data Privacy, File-AID Services must be installed on a Windows or Linux server by your System Administrator as described in the Data Privacy chapter of the Topaz Workbench Installation Guide. a. Select Window > Preferences, expand Compuware and select File-AID Services. b. Type the URL for your File-AID Services. An example URL is c. Click Test Connection. d. If you get a Connection Successful message, click Apply and OK. Click OK again. You will return to Topaz Workbench. 3. From the Topaz Workbench Welcome window, click the Data Privacy icon, or from the Topaz Workbench menu, select Compuware > File-AID Data Privacy. This opens the Data Privacy Explorer view and shows the available repositories. If your Data Privacy Explorer pane is empty, click the Refresh icon to list your available repositories. 4. Your Data Privacy Administrator must assign you a user role. The first time you start data privacy, if your role has not yet been assigned, you will receive a "No Roles" error message. Without a role assignment, you will be unable to perform any data privacy tasks. For a description of the default security roles, see Manage Security. For a description of how to add, update, or delete a user role, see Configure Security. 5. If you wish to use a repository other than the default Derby repository that comes with File-AID Services, you must first create it. For instructions on how to do this, see Manage Data Privacy Repositories. To create a new repository, you need to be assigned the Compuware Data Privacy Global Resource Admin role or the "Compuware Data Privacy Admin" role. Other roles are not permitted to create new repositories. 6. Before you can use data privacy for mainframe data, you must define a mainframe host in Topaz Workbench. For complete details for defining a host, see the Host Explorer online help. In general, to configure a new host, you must:. Open the Host Explorer view.

18 a. Right-click on Hosts and select Configure > Host Connections on File-AID Services from the list. The File-AID Services Connections dialog box appears. b. To configure a mainframe host, select the HCI tab, and click Add. The File-AID Services Administration dialog box appears. c. Enter the User ID and Password. Initially, the user ID is "cwadmin"and the password is the same: "cwadmin". If you are the Administrator, the password should be changed by providing the new password of your choice. d. Click OK. The Host Connections dialog box appears. e. On the General tab, enter the Host, Port, and an optional Description. f. Optionally, select the Secure connection check box to enable an encrypted secure HCI connection. Then choose the encrypted protocol your mainframe is configured to use. Selecting Auto will cause Host Explorer to check to see what version of TLS or SSL you have. g. Optionally, select the Credentials tab which enables you to manage any credentials you have saved for this host during Login. h. Optionally, select the Advanced tab to reveal additional parameters: Read/write timeout (seconds) determines the amount of time Host Explorer will wait for a response from the HCI before timing out. I/O trace level should only be changed from the default of None when directed by Compuware Customer Support. i. Click OK. You will return to the File-AID Services Connections dialog box. Your new mainframe host will now appear in the list of hosts. j. To add a new database connection, click the JDBC tab and click Add. The Database Connection dialog box appears. k. On the General tab, select the database type (IBM DB2 for Linux, Unix, and Windows; IBM DB2 for z/os; Oracle; SQL Server; Sybase) from the list. Enter the database host, port number, location/sid, and an optional description if desired. For Oracle you may also select a Connection Type (SID or Service name). Optionally, you may select the Properties tab to define and manage any additional properties. The Credentials tab is provided to enable you to manage any login credentials you have saved for this database during Login. l. Click OK. You will return to the File-AID Services Connections dialog box. Your database connection will now appear in the database list. m. Click OK. You will return to Topaz Workbench. n. When you try to access a mainframe host or a database connection in the Host Explorer view, a login dialog box appears. Enter your login credentials. For the mainframe, enter your mainframe user ID and password. For a database, enter your database ID and password. You can now access only the information that you are authorized to access. For example, you will only be able to access those files that you can access if you were logged on to the mainframe or your database.

19 Working with a Project 7. A repository must be opened before you can create or select a Data Privacy project. To open a repository, double-click it or right-click and select Open Repository. This provides a list of projects within that repository that you can work with. Note: If the repository you expected to see does not appear in the list, click Refresh. If you click Refresh, any open projects will be closed and any changes you have made during this session since the project was last saved will not be saved. A message box appears giving you the option to continue and lose changes or cancel. 8. To create a new project (or your first project), see Create a New Data Privacy Project for complete details. Note: Perspectives and views can be opened and closed as desired and windows can be repositioned within the display. When you exit Topaz Workbench, your current perspectives are saved. The next time you start Topaz Workbench, the same perspectives that were open when you exited will reopen. Creating Credentials and Translate Tables 9. Credentials are required at disguise execution time to allow the disguise job to access the values stored in translate tables. For information on how to create new credentials, see Create New Credentials. Translate table definitions require credentials. The credentials can be created prior to defining the translate table or they can be added from within Manage Translate Tables. Credentials are created through Resource Administration, and you must be a Data Privacy Administrator or a Data Privacy Global Resource Administrator to create, delete, or modify credentials. 10. Translate tables allow you to use a table of replacement values for data that you want to disguise. For a description of translate tables, see Manage Translate Tables. For information on how to create new translate tables, see Create a New Translate Table. Translate tables are created through Resource Administration, and you must be a Data Privacy Administrator or a Data Privacy Global Resource Administrator to create new translate tables. To return to the Welcome window, select Help > Welcome. Managing Repository Content There are several repository options in the Data Privacy Explorer view. Right-click on a repository to see the following choices: Create New Project: Right-click on the open repository name and select Create New Project to open the Create New Privacy Project dialog box. For more information, see Create a New Data Privacy Project. Close Repository: Right-click on the open repository name and select Close Repository to close all open projects and then close the repository. Import Project: Right-click on the open repository and select Import Project. This command allows you to import a project that has been exported using the Export Project option available from the project. Only the Data Privacy Administrator can import project XML back into Data Privacy.

20 The import feature can only import a project that was exported from a repository with the exact same repository version. When this option is selected, a dialog will be displayed where you will specify the location of the project to be imported. You can also optionally specify a new Project Name, Short Name, and Description. This allows you to quickly create a copy of a project and use it to work on variations. The project ID assigned to the original project will be retained during the import, so any specifications which reference the original project can execute against the imported project as long as the correct repository is specified. If the original project ID is already being used in the repository, a warning message will be displayed and you can choose to import with a new project ID. If any of the shared resources for credentials, managed keys, translate tables, or custom functions being used in the imported project are already defined in the repository, a warning message will be displayed and you will have the option to import the resources, use the existing resources, or cancel the import. If the project imported makes use of custom functions, it will be accompanied by a folder with the custom function resources made available in the same location as the XML file. The folder will have the same name as the project XML with the suffix "_CustomFunctionResource". If the root resource folder is missing, or if the respective folder for the custom function resources is missing within that folder, or if the main implementation class is missing, the import process will display a message with that information. Note: You cannot use Import project to import into the Global project; if any global definitions were used in the project being imported, they will be defined as local resources and will not be associated with any global project definitions. The import will bring everything used by the project in together. Edit Data Privacy Repository: Right-click on the open repository name and select Edit Data Privacy Repository. This command allows you to directly edit the project and translate table definitions that are defined in the repository and is useful when host, port, dataset, and schemas must be changed to allow a project to be executed in an environment other than the one where it was defined. CAUTION: Always create a backup of the repository before using this utility. Use extreme caution when editing. See Editing the Data Privacy Repository for more information on this utility. Managing Projects There are several project options in the Data Privacy Explorer view. Right-click on a project to see the available actions. The following action is only available for closed projects: Open Project: The Open Project command is available if the project is not yet open. To open a project from the Data Privacy Explorer view, right-click the desired project and select Open Project or double-click the project name. Note: Multiple projects can be open at the same time. To modify a project, it must be open. The following actions are available for both open and closed projects:

21 Delete Project: Right-click a project and select Delete Project to remove the project from the repository. Once deleted, it will no longer be available and will not appear in the project list. View Project Summary: Right-click a project and select View Project Summary. A project summary provides information about the project, its metadata, data elements, source data identifiers, and rules including rule actions, rule logic, and rule variables. Export Project: Right-click a project and select Export Project. The Save As dialog box appears allowing you to specify where to save the project. This will most often be used if you need to request help from Compuware Customer Support and will save the content of the entire project. A project can be saved to XML whether it is open or closed. If an XML file with the same name exists, a message is displayed and you can choose to either enter a new name or overwrite the existing file. If a custom function resource folder with the same name exists, a message is displayed and you can choose to either overwrite the existing folder or cancel the export (even though the project's XML file would have already been exported at that point). The following actions are only available for open projects: Lock Project: If you have used global data elements or global rules in your project, they are normally updated automatically whenever the data elements or rules are updated at their source. If you wish to prevent these updates from occurring automatically in your project, right-click the project and select Lock Project. Updates to the global data elements or global rules will no longer be applied to your project. After this, if the global data elements or global rules are updated, you will get a notification message that updates have occurred each time you open the project. Unlock Project: After a project is locked, you can unlock it by right-clicking the open project and selecting Unlock. The changes from updated global datasets or rules will take effect after you click Refresh or close and reopen the project. Data Privacy Views Data Privacy Views Data Privacy provides several views including the Data Privacy Explorer, Host Explorer, and Data Privacy Menu. The Data Privacy Menu offers additional views that allow you to perform additional data privacy tasks. One way to access other views is by selecting Window > Show View > Other, then expanding the Data Privacy folder and selecting the desired view from the list. This opens a tab for the selected view. If more than one view tab is open, you can switch between views by selecting the desired tab. Another way to open a view is to select it from the Data Privacy Menu. This view contains the Resource Administration and Reports stack bars. These stack bars have options available for selection. Click one of these options to select it and open a view for that option. To close a view, click the close icon on the right portion of the tab. The close icon appears only while the tab is selected.

22 Data Privacy Explorer View The Data Privacy Explorer view lists all of the projects, by repository, that you are authorized to view. The global project is listed first, and the rest of the projects are listed alphabetically after the global project. The Data Privacy Explorer includes a filter field at the top that enables you to refine the list of projects, making it easier to find the project you're looking for. Filtering can be done based on project name and/or project ID. An asterisk (*) can be entered as a wildcard character to substitute for zero or more characters of the filter string. As the filter string is being entered, the list of displayed projects is refined to only those matching the filter. The Data Privacy Explorer and Host Explorer views are always available when you first open the Data Privacy perspective. You can move their location in the window based on your preferences, and you can close the Host Explorer view, if desired. See Managing Repository Content and Managing Projects for details on each of the options available from the Data Privacy Explorer. Data Privacy Menu - Stack Bars The Data Privacy Menu view contains stack bars that provide additional options for managing your data privacy projects. The following stack bars are available: The Resource Administration stack bar provides the following options: o o o o o Manage Encryption Keys: Encryption keys are used by disguise rules as part of the process of defining format-preserving encryption actions. Each action uses the specified encryption key to determine the replacement value for the encryption key. For more information, see Manage Encryption Keys. Manage Translate Tables: A translate table is a table of replacement values for the data that you want to disguise. The Manage Translate Tables view lists the currently defined translate tables. For more information, see Manage Translate Tables. Manage Data Privacy Repositories: This view allows you to add, remove, or migrate your data privacy repositories. For more information, see Manage Data Privacy Repositories. Manage Credentials: This view allows you to add, modify, or delete data privacy credentials. For more information, see Create New Credentials. Manage Custom Functions: Allows you to create, edit, and delete custom functions. For more information, see Manage Custom Functions. The Reports stack bar contains the Coverage Analysis Report. For more information, see Coverage Analysis Report. Data Privacy Repositories

23 A data privacy repository is used to store the shared disguise rules along with other information required for the data privacy implementation. When File-AID Services is installed, a default rules repository is created within a Derby database. The Derby database does not require any special licensing. However, it is highly recommended that a new repository be created that will be backed up on a regular basis. Sample global data elements are pre-populated into the default rules repository. When a repository is created, it always contains at least one project - the default global project. After that, projects are created as needed. Additional or alternate rules repositories can be created on your choice of database including: SQL Server, Sybase, Oracle, DB2 UDB, or DB2 z/os. Repository names must be unique within the server. Note: When you create a DB2 database, it needs to have a page size of at least All of the repositories that are defined are available within the Data Privacy Explorer, but only one repository can be open at a time. If you open another repository while one is already open, the first repository is closed before the second is opened. When a new repository is added to File-AID Services, the tables required for a rules repository are created in the selected DBMS. When defining the repository, a user ID and password are requested and are subject to normal database authentication during creation and access. In addition, the user ID must have table create permission to define a repository. Also, when a new repository is created, the repository is immediately available for all new requests for repository list. It will appear when the user interface client is restarted or refreshed. Access to the functions that update the rules repository is controlled by role-based authorizations. However, each user does not have to be specifically authorized for access to the underlying database tables since that access is always performed by the server using the defined user ID and password rather than the user ID and password of the person assigned to the data privacy role. Global Project Definitions Global project definitions allow for data elements and rules to be shared across projects. Whenever a repository is created, the global project is automatically created. The global project contains the sample data elements that are available for use in all projects. Additional data elements and rules can be added to the Global project. Global Definitions Global data elements and global disguise rules are managed by opening the global project and selecting the data element or rule to be modified. Editing a global data element is exactly like editing a regular data element. The processing options are specified as are the source data identifiers. It is expected that source data identifiers created at the global level will be very general and will be based only on field name. These identifiers cannot be populated from project metadata because the global project does not have any metadata defined. For more information, see Create a New Data Element. Global rules must always be created using only global data elements or global rule variables. For more information, see Create a New Data Privacy Rule.

24 Importing Global Data Elements and Rules To use a global data element or rule, you must import it into your project. You can access the import function on the Data Elements view and the Rules view. After clicking Global, you can choose from the list of global data elements or global rules. When a rule is imported, all of the definitions required by that rule are also imported automatically if they are not already in the project. When the data element or rule is imported, it immediately becomes available in the list of data elements or rules for your project. Within a project, you can extend a global data element definition by adding additional source data identifiers. This does not change the original global definition. In addition, after the global data element has been imported into your project, the processing options and global identifiers can be viewed within your project, via the summary, but they cannot be modified from within the project. After being imported, a global rule's content can also be viewed from within a project, via the summary, but cannot be modified. This means, for example, that you cannot add additional rule actions to a global rule that you have imported into your project. Updates to Global Data Elements and Rules Updates to global data elements or rules are normally applied automatically to your project whenever the data elements or rules are updated at their source. If you wish to prevent these updates from occurring automatically in your project, right-click the project in the Data Privacy Explorer view and select Lock Project. Updates made to the global data elements or global rules will no longer be updated in your project. After this, if the global data elements or global rules are updated, you will get a notification message that updates have occurred each time you open the project, execute the rules, or run a report. You can only lock a project when the project is open. Importing Composites To use a global composite, you must import it into your project. You can access the import function on the Composites view. After clicking Global, you can choose from the list of composites. When a composite is imported, all of the required data item and category definitions are also imported automatically. When the composite is imported, it immediately becomes available in the list of composites for your project. Within a project, you cannot change the definition of the global composite.

25 Data Privacy Projects Data Privacy Projects To use File-AID Data Privacy, you must create or open a project where you will define your metadata, data elements, and rules. Note: Described below are the functions that data privacy provides. However, to perform any of the following actions, you must have the appropriate permissions. If the function is outside of your data privacy authorization, it will be disabled, or you will not even see the choice since you are not permitted to use it. The person who creates a project automatically becomes the Data Privacy Project Administrator. That person remains the Data Privacy Project Administrator until changed by the Data Privacy Administrator or the Data Privacy Project Administrator. Only the project owner or the Data Privacy Administrator can delete a project after it is created. The Data Privacy Administrator has authorization to all projects and can do everything, including updating the project and assigning a new owner to the project. You can access your projects from the Data Privacy Explorer view. When a repository is open, all projects defined within that repository are listed. To make changes to your project, it must be open, and to open the project, you must have a role authorization that allows you to open and change the project. The data privacy definition within a project consists of Data Elements, Rules, Metadata, Composites, and Extensions. You can view or update this information by selecting the appropriate tab at the bottom of the selected project's view. Metadata is shown on the Coverage tab. Double-clicking the project name opens the project and displays the Project Overview view. Here, with the appropriate permissions, you can modify the Name, Short Name, Description, and Data Privacy Project Administrator. Right-click a project to perform the following tasks: Open a project that is not currently open. Delete a project. Lock a project that is currently unlocked or unlock a project that is currently locked. The project must be open for this task to appear in the list. View a project summary. A project summary provides printable information about the project, its metadata, data elements, source data identifiers, and rules including rule actions, rule logic, and rule variables. Export project. To export a project, right-click the project name in the project tree view and select Export Project. When the Save As dialog box appears, navigate to the location where you want to store the project resource file. The default file name is the same as the project name, but it can be changed. Only the Data Privacy Administrator can export a project. A global project, named Global, is automatically created when you create a File-AID Data Privacy repository. You can import global data elements or global rules from the global project into your data privacy project. For more information, see Global Project Definitions.

26 Create a New Data Privacy Project All of your data privacy definitions must be made within the boundaries of a project. Note: A Data Privacy project can also be created from the command line. For more information, see Batch Import Utility. To create a new Data Privacy project 1. Open the repository where you want the data privacy project to reside. 2. To add a project, right-click on an open repository and select Create New Project. The Create New Privacy Project dialog box appears. 3. Enter a Name for your project. Project names must be unique within a repository. Note: Data Privacy project names are not case sensitive. So, you will get a duplicate project name error if you use the same project name in upper case and again in lower case. 4. Enter a Short name for your project. The short name must be eight characters or fewer and follow mainframe naming conventions for dataset names. The short name is required because it will eventually be used as a node within the audit trail dataset. 5. Enter an optional description for your project. 6. Click OK. You will return to the previous view. Your project now appears alphabetically in the Data Privacy Explorer view below the global project. To open this project, double-click the project name, or right-click the project name and select Open Project. If no other project is currently open, this project will open automatically when created. The information on the Project Overview is now filled in with the information you entered when you created the project. Note: Multiple projects can be open at the same time. What to do with a project after it is created 7. You need to create new data elements or import global data elements for this project. For complete details about how to work with data elements, see the Manage Data Elements topic and the other related topics in that section of the help. The Manage Data Elements section provides detailed information about data element processing types, what to do with invalid, null, and long data values, and how to create source data identifiers, set processing options, deal with data identifier restrictions, and import global data elements. 8. You need to create new rules or import global rules for this project. For complete details about how to work with rules, see the Manage Project Rules topic and the other related topics in that section of the help. The Manage Project Rules section provides information on how to create a new rule, import a global rule, create rule actions, and create with rule variables. 9. Add project metadata if desired. Using existing metadata is optional. See Manage Metadata for information about what type of metadata you can use, and see Add Project Metadata for information on adding existing metadata to your project.

27 10. After your data elements and project rules have been created, you will use one of Compuware's File-AID products (for which you have a license) to access your dynamic privacy rules and disguise your data. Project Overview After you create a new data privacy project, a project overview is automatically created. From the project overview, you can view and change the name of the project, the short name of the project, the project description, and the project owner. In addition, version, creation date, created by, updated date, and updated by information is shown. At the bottom of the window are additional tabs for Data Elements, Rules, Coverage, Composites, and Extensions, allowing you to manage your project. There are also links on the project overview page that will navigate to the appropriate tab or allow you to: add metadata create a new data element create a new rule export, import, and manage execution parameters. Rename a Data Privacy Project After a data privacy project has been created, only the Data Privacy Project Administrator or the data privacy administrator is authorized to rename it. Note: All Data Privacy projects are listed in the Data Privacy Explorer view. The person who creates a project automatically becomes the Data Privacy Project Administrator. That person remains the Data Privacy Project Administrator until changed by the Data Privacy Administrator or Data Privacy Project Administrator. To rename a Data Privacy project 1. Select and open the desired project from the Data Privacy Explorer view. 2. In the Name field, overtype the existing project name with the desired new project name and click the Save icon. This renames the project and updates the project name in the Data Privacy Explorer view. Delete a Data Privacy Project When a data privacy project is no longer needed, only the Data Privacy Project Administrator or the data privacy administrator is authorized to delete it.

28 Note: All Data Privacy projects are listed in the Data Privacy Explorer view. The person who creates a project automatically becomes the Data Privacy Project Administrator. That person remains the Data Privacy Project Administrator until changed by the Data Privacy Administrator or Data Privacy Project Administrator. To delete a data privacy project 1. Select the project from the Data Privacy Explorer view. 2. Right-click and select Delete Project. You will get a confirmation message to confirm that you really want to delete the project. 3. Click OK and your project will be deleted and will no longer appear in the Data Privacy Explorer view.

29 Manage Data Elements Manage Data Elements Data Elements provide a sharable definition of a data item or field. These descriptors can be defined at either the global or project level. A global data element can be shared by multiple projects through the import process. Within a project, you will create a data element for each different data item that is to be acted upon during the disguise process. A data element by itself is nothing more than a name that is used to reference the data item during disguise definition. Data element names must be unique within a project. From the Data Elements view, you can add a new data element, edit, rename, or delete an existing data element, disable one or more data elements, import a global data element, or import data elements from a file. You can also view the data element summary. Global data elements must be imported into projects before they can be used by the disguise process. Source data identifiers locate the actual data associated with a data element. The identification process matches the source data identifiers defined in the data element to the field and column names defined within the metadata. To define a data element, specify the processing options and source data identifiers required for that data element. At execution time, processing options determine how data values are handled during normalization and disguise. Data element options include selecting a processing type, value alignment, invalid/long data options, null values, and references. All processing options have default values. Source data identifiers provide field names and patterns that are used to locate instances of data at disguise time. You can save your data element before you specify any source data identifiers, but it is not usable since it cannot locate data until source data identifiers are defined. Rules can also be created using a data element without defined source data identifiers. However, again, it cannot locate data. The normalized format is the format upon which the disguise rule is built. Normalization removes any differences in data that are attributable to the format in which the data is stored or the platform where the data originated. Before the disguise rule is applied, the data from the source field is converted to a standard format so the disguise rule will always see the data in the same format. Since the disguise rule only sees the data in the normalized format, it returns consistent results. After the rule is processed, the disguised value is converted back from the normalized format to the format of the source data. Unicode is the format for normalized data, so all disguise techniques will act on Unicode data. Create a New Data Element A data element can be created as a global data element to be used by multiple projects, or it can be created specifically for a project and used only by that project. The user role assigned determines who can create a new data element. For more information, see Manage Security and Role Authorizations.