topic Re: Masking credit cards in Security

Masking credit cards

cjs226 — Sat, 09 Apr 2011 03:16:59 GMT

While I'm able to mask 16 digit numbers I would like a more sophisticated approach as there are some numbers in that range that are not credit card numbers which I don't want to mask, such as error codes. Is anyone utilizing the Luhn Algorithm (http://rosettacode.org/wiki/Luhn_test_of_credit_card_numbers) or something better than my current approach?

Re: Masking credit cards

southeringtonp — Sat, 09 Apr 2011 03:39:51 GMT

Splunk by itself is only going to be able to mask based on regex replacement, but that doesn't necessarily mean any 16-digit string.

If you want to fully run the Luhn algorithm, you'd need to be using a scripted input to Splunk, or have some external form of pre-processing.

Re: Masking credit cards

cjs226 — Sun, 10 Apr 2011 22:40:42 GMT

Thanks, I'm using the info from the first link you mention but the 2nd won't work (completely) for me as I have to account for different and yet to be determined credit card companies. This is why I'm hoping for a solution that incorporates the Lunh Algorithm or a better approach.

Re: Masking credit cards

MicroAlpha — Fri, 20 Mar 2015 13:43:35 GMT

For an external form of pre-masking for Splunk, see:

http://www.iri.com/blog/data-protection/secure-then-splunk-a-format-preserving-encryption-and-pseduonymization-example/

Re: Masking credit cards

sachol — Mon, 20 Apr 2015 21:12:36 GMT

from that site, they can either use a masking tool with a canned CCN mask:

www.iri.com/solutions/data-masking/masking/mask-credit-card-number

or generate CCNs with a test data generator (using Luhn), but again, external to Splunk:

www.iri.com/blog/test-data/generating-test-credit-card-numbers/