I was at Microsoft in Redmond recently and heard an interesting comment from a SQL Server developer. I was debating the data masking feature with a friend, and we were torn on the value of this for various situations we'd each encountered in the past. There are some restrictions, and it doesn't seem that data masking is really offering a lot of security.

The Microsoft developer, however, noted that this isn't really a high security feature. It's a developer feature. The design of data masking is to prevent that same code from being rewritten over and over by application developers. The use case is really to help with systems that might read some data, like those that print off part of an account number, ID number, credit card number, etc.

If you read up on the restrictions, this makes sense. If you are just trying to make development more convenient, the feature makes sense. I hadn't thought about that use case, but the more I consider this, the more I'm sure that data masking does remove a bunch of code that developers might be re-implementing themselves, perhaps with highly variable levels of quality. It also removes the chance that application developers will accidentally pull sensitive data to a client and (poorly) implement mask replacement there.

I think this feature is being mis-marketed a bit, really to increase sales to executives and management. I'm sure there isn't anything we can do about that, but I'd love to see technical documents and information about this for developers and DBAs. Give us a more realistic use case and give us better guidance. I think if we got that for many features, there might be more positive responses and great interest from technical professionals to the changes in the SQL Server platform.