Restrict Date of Birth visibility to only authorized users in ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi all,

We need to protect DOB in ISC , it comes from our authoritative HR source (JDBC) and is mapped as an identity attribute. Requirement: only certain authorized users should see it, not everyone who can view identities

Is there any way to mask or restrict visibility of a specific identity attribute (by user level or governance group)?

2

Hi @pguduri,

I don’t believe there is a way to enforce that restriction.

If that attribute is required, a better approach would be to mask the value before storing it on the identity and then unmask it wherever it needs to be used.

3

I think this is what you are looking for.

4

SailPoint Identity Security Cloud (ISC) currently does not support user attribute-level masking or user-level data segmentation.
The recently introduced Data Segmentation feature enables organizations to restrict access at the role and entitlement level.

With Data Segmentation, designated users can view and manage only the roles and entitlements within the segments they have been granted access to. This includes the ability to name, describe, create, configure, and maintain roles and entitlements that fall within their assigned scope. More details are available in the SailPoint Data Segmentation documentation: Data Segmentation Overview - SailPoint Identity Services.

5

This is not foolproof, but might work as a compromise between security and getting the work done

  1. Using JDBC Buildmap rule, encrypt the DOB. (Securely storing and using of encryption key in this step is crucial.)
  2. Same encrypted value is written to Identity attribute
  3. Create a Interactive Trigger Workflow that can call a Powershell script and pass the DOB identity attribute that is in encrypted format.
  4. Powershell script will decrypt the string and return the DOB (using the same key as in Step 1)
  5. Limit the access to the Launcher to users who are authorised to view the DoB.
6

Hi @PragatiGupta

In my opinion, this is not something you should try and achieve in ISC. For similar scenario, you could create a report or may be some other report showing the required data.
I have prior experience of PowerBI reporting where there is a possibility of Row level security which you can use to provide access to these authorized persons to see sensitive information.

Thank You.

Regards

Vikas.

7

Hello,

From the UI Customization perspective, you cannot perform a restriction on identity attribute getting displayed only to subset of the users in ISC. As of today, its not available in sailpoint ISC i think.