topic Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level in Workato Pros Discussion Board

Enhancement? Data Masking at a Recipe Level and/or Connector Level

mroldanvega — Wed, 06 Oct 2021 02:33:26 GMT

It would be great if we could set up the data masking flag at a recipe leval, or at a connector level. In recipes with lots of actions, it is difficult to keep track and manage which actions were masked and which were not.

Anyone has any suggestions for this?

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

tridivesh — Wed, 06 Oct 2021 02:56:57 GMT

Manuel Roldan-Vega - Interesting idea. Can you share some examples where there would be a requirement to completely mask the data for a recipe or for a connection?

Deven Maru -FYI

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

deven-maru — Wed, 06 Oct 2021 04:32:50 GMT

Thanks Tridi.

Manuel Roldan-Vega if masking is at the recipe level it would mean all actions in the recipe will be masked and not show the data. Is that what you're expecting? Or do you want visual indicator on recipe step to know masked steps?

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

mroldanvega — Wed, 06 Oct 2021 04:52:13 GMT

Let's say we develop a recipe that reads and updates data to the HR system. While developing the recipe it is very useful to see the logs for troubleshooting.

Let's say the recipe has over 50 steps.

Once it goes to production, we need to go and edit on each step connected to the HR system and choose to mask the data.

It would be great if we could select to mask the data for all the steps at once, without having to select it on each step.

So, yes Deven Maru , i would expect all actions in the recipe to be masked.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

deven-maru — Wed, 06 Oct 2021 06:36:39 GMT

Thanks Manuel Roldan-Vega. That's helpful. Let me review this and see what it means to add the masking at the recipe level from platform and user experience perspective.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

steven-marissen — Wed, 06 Oct 2021 14:17:44 GMT

I assume it would also come in handy to have the main recipe provide context to underlaying (possibly shared) callable recipes whether to process that request confidentially or not depending on which main recipe it gets called from.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

deven-maru — Thu, 07 Oct 2021 04:34:08 GMT

hi Steven Marissens good question. Our approach has been to keep the settings at per recipe level for all recipe types (trigger based or callable). Since the callable recipe is also a recipe on its own, the recipe level settings are available there as well to provide maximum flexibility to the users. It becomes important in cases where the callable recipe is a shared recipe where the context could be different depending on the calling recipe. Since it's a recipe level setting it will apply to all jobs of the callable recipe regardless of which recipe called it.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

tridivesh — Thu, 07 Oct 2021 05:29:16 GMT

Manuel Roldan-Vega Steven Marissens Deven Maru :

Since turning on data masking turns off logging, you lose the access to the data for troubleshooting. If the primary purpose of data masking is to keep data protected/private from "unauthorized eyes", would a special permission to view logs suffice? Whether it be masking recipes, connections or steps in a recipe, it still does require a good amount of rigor/discipline to turn on masking.

It would be simpler to block users/roles from viewing log data, the same way network tracing access works today?

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

mroldanvega — Fri, 08 Oct 2021 01:58:04 GMT

Tridivesh Sarangi - The only problem i see is that it would 'hide' all the logs, and not logs specific to a connection/application. So it is an all or nothing.

Also, will the role only prevent the user from seeing the data, but would still allow to see the execution table (job id, time, etc.), or would it hide the complete job tab in the recipe?

cc. Deven Maru Steven Marissens

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

mroldanvega — Tue, 12 Oct 2021 12:28:32 GMT

Tridivesh Sarangi - one other consideration here is that with data masking you are not storing sensitive data in the logs, but with the permissions approach you are (just hiding it). I think this has can have implications from a compliance perspective. Yet again, for compliance we could set the masking at a step level.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

deven-maru — Tue, 12 Oct 2021 13:11:52 GMT

Manuel Roldan-Vega

> Also, will the role only prevent the user from seeing the data, but would still allow to see the execution table (job id, time, etc.), or would it hide the complete job tab in the recipe?

It will hide the Jobs tab.

One of the features we're working on is "zero retention" or "no retention" where you'd specify at a recipe level if you want Workato to store job data. If zero retention is enabled, then Workato will not store any data. You will see job execution history with job ID, time etc. but no other data related to that job will be stored.

Do you think something like zero retention may be more suitable for what you're thinking? Insteaf of masking at recipe level.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

mroldanvega — Wed, 13 Oct 2021 02:50:36 GMT

Hi Deven Maru ,

Thank you for your reply.

Yes, the 'zero retention' feature sounds very promising. Is there a timeline for it (if you can share)? Will it be enabled/disabled easily or once and for all? Will it be controlled by the admin, operator, or will there be custom permissions for it?

Honestly, I didn't think that data masking at a recipe level would be very difficult. Since every action in the recipe is linked to the connection I thought it would be rather easy to toggle something at a recipe level and look for all actions on that recipe with the relevant connection and enable data masking for it.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

deven-maru — Thu, 14 Oct 2021 04:30:27 GMT

Hi Manuel Roldan-Vega I agree that data masking at a recipe level may not be difficult to do but we'll have to cover different scenarios when all steps are masked. Let me explore it.

Re: Enhancement? Data Masking at a Recipe Level and/or Connector Level

mroldanvega — Thu, 14 Oct 2021 05:00:15 GMT

Thank you!