# Encryption, masking and safe test data

Explain the difference between encrypted, masked and anonymous data. Govern keys, re-identification risk and test copies together.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## The boundary protected by encryption

Disk, transport and application-level encryption address different threats. Misuse remains possible by an account that can access keys and plaintext. An encrypted indicator does not establish the actual scope or algorithm. Review key ownership, separated access, backup and recovery tests. Harbor accepts its encrypted metadata as an assertion and verifies no file or network cryptography. A lock icon cannot make every recipient and purpose appropriate. Evaluate what remains exposed after authorized decryption and how permissions protect that boundary as well as stored or transmitted bytes.

## Masking is not an anonymity guarantee

Removing names can still leave combinations of location, age, dates and other fields that identify someone. Pseudonymization, tokenization and anonymization are not interchangeable outcomes. NIST SP 800-188 frames evaluation through risk, sharing models and governance. Assess analytical utility alongside disclosure risk. A regex, hash or replacement with asterisks does not justify declaring the result non-personal. This package includes no real-data anonymization tool. Learners explain which quasi-identifiers and external linkages require further assessment rather than assuming that removing an obvious name settles the issue.

## Limit test data to the task

Copying production into test expands access, retention and copy-management scope. Prefer appropriate synthetic data, with evidence that actual source records were not merely relabeled synthetic. Choose necessary fields and edge cases from the test purpose. Prevent side effects such as real emails or notifications. Harbor uses explicitly fictional metadata only. Old test copies without refresh, access or disposal ownership belong in the risk inventory too. A development-environment label does not replace controls, and passing functional tests does not establish that a dataset is safe to distribute.

## Validate the protection outcome

Tie a control choice to the conditions under which loss or disclosure is prevented. Key-loss recovery, export by an authorized user and linkage risk in masked data require different tests. Keep revision and scope aligned with the evidence. Harbor distinguishes a protection assertion from actual validation and accepts no cryptographic keys or personal examples. Assign owners and dates to unresolved gaps. The goal is not identical concealment of every field but meeting business needs through appropriate protection and traceable risk assessment, with no unsupported anonymity claim.

## Working sequence

1. Record threats and permitted-use boundaries.
2. Separate key and plaintext access.
3. Review quasi-identifiers and linkage risks.
4. Choose minimal synthetic fields for the test purpose.
5. Record validation, recovery and cleanup plans.

## 1. Encrypted: no problem?

An encryption indicator establishes neither key separation nor recoverability. General confidentiality and availability assurance needs access and key-lifecycle review.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.encrypted === true
```

### Corrected implementation
```js
s => s.encrypted === true &&
  s.keysSeparated === true &&
  s.accessReviewed === true &&
  s.recoveryTested === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "encrypted": true,
        "keysSeparated": true,
        "accessReviewed": true,
        "recoveryTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-keysSeparated",
      "input": {
        "encrypted": true,
        "keysSeparated": false,
        "accessReviewed": true,
        "recoveryTested": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-recoveryTested",
      "input": {
        "encrypted": true,
        "keysSeparated": true,
        "accessReviewed": true,
        "recoveryTested": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "encrypted": true,
        "keysSeparated": true,
        "accessReviewed": true,
        "recoveryTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-keysSeparated",
      "input": {
        "encrypted": true,
        "keysSeparated": false,
        "accessReviewed": true,
        "recoveryTested": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-recoveryTested",
      "input": {
        "encrypted": true,
        "keysSeparated": true,
        "accessReviewed": true,
        "recoveryTested": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Names removed

Removing names does not eliminate quasi-identifiers or re-identification risk. Assess them with sharing purpose and utility; this model gives no anonymity approval.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.namesRemoved === true
```

### Corrected implementation
```js
s => s.namesRemoved === true &&
  s.quasiIdentifiersReviewed === true &&
  s.reidentificationRisk === true &&
  s.utilityChecked === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "namesRemoved": true,
        "quasiIdentifiersReviewed": true,
        "reidentificationRisk": true,
        "utilityChecked": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-quasiIdentifiersReviewed",
      "input": {
        "namesRemoved": true,
        "quasiIdentifiersReviewed": false,
        "reidentificationRisk": true,
        "utilityChecked": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-reidentificationRisk",
      "input": {
        "namesRemoved": true,
        "quasiIdentifiersReviewed": true,
        "reidentificationRisk": false,
        "utilityChecked": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "namesRemoved": true,
        "quasiIdentifiersReviewed": true,
        "reidentificationRisk": true,
        "utilityChecked": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-quasiIdentifiersReviewed",
      "input": {
        "namesRemoved": true,
        "quasiIdentifiersReviewed": false,
        "reidentificationRisk": true,
        "utilityChecked": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-reidentificationRisk",
      "input": {
        "namesRemoved": true,
        "quasiIdentifiersReviewed": true,
        "reidentificationRisk": false,
        "utilityChecked": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Production copy ready

A production copy establishes neither minimal test data nor retention ownership. Review synthetic alternatives, field minimization and cleanup accountability.

This code is a local policy model; it does not replace actual content discovery, DLP or sanitization validation.

### Weak implementation
```js
s => s.productionCopyExists === true
```

### Corrected implementation
```js
s => s.productionCopyExists === true &&
  s.syntheticPreferred === true &&
  s.fieldsMinimized === true &&
  s.refreshAndDeleteOwned === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "productionCopyExists": true,
        "syntheticPreferred": true,
        "fieldsMinimized": true,
        "refreshAndDeleteOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-syntheticPreferred",
      "input": {
        "productionCopyExists": true,
        "syntheticPreferred": false,
        "fieldsMinimized": true,
        "refreshAndDeleteOwned": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-refreshAndDeleteOwned",
      "input": {
        "productionCopyExists": true,
        "syntheticPreferred": true,
        "fieldsMinimized": true,
        "refreshAndDeleteOwned": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "productionCopyExists": true,
        "syntheticPreferred": true,
        "fieldsMinimized": true,
        "refreshAndDeleteOwned": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-syntheticPreferred",
      "input": {
        "productionCopyExists": true,
        "syntheticPreferred": false,
        "fieldsMinimized": true,
        "refreshAndDeleteOwned": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-refreshAndDeleteOwned",
      "input": {
        "productionCopyExists": true,
        "syntheticPreferred": true,
        "fieldsMinimized": true,
        "refreshAndDeleteOwned": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- Encryption scope, key ownership and recovery matrix.
- Masking/re-identification and test-copy assessment.

## References

- [NIST SP 800-188 · De-identification techniques and governance · September 2023](https://csrc.nist.gov/pubs/sp/800/188/final)
- [NIST SP 800-209 · Storage infrastructure security · October 2020](https://csrc.nist.gov/pubs/sp/800/209/final)
- [EDPB · Anonymisation and pseudonymisation](https://www.edpb.europa.eu/topics/ai-and-technology/anonymisation-pseudonymisation_en)