Restrict Date of Birth visibility to only authorized users in ISC

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi all,

We need to protect DOB in ISC , it comes from our authoritative HR source (JDBC) and is mapped as an identity attribute. Requirement: only certain authorized users should see it, not everyone who can view identities

Is there any way to mask or restrict visibility of a specific identity attribute (by user level or governance group)?

2

Hi @pguduri,

I don’t believe there is a way to enforce that restriction.

If that attribute is required, a better approach would be to mask the value before storing it on the identity and then unmask it wherever it needs to be used.

3

I think this is what you are looking for.

4

SailPoint Identity Security Cloud (ISC) currently does not support user attribute-level masking or user-level data segmentation.
The recently introduced Data Segmentation feature enables organizations to restrict access at the role and entitlement level.

With Data Segmentation, designated users can view and manage only the roles and entitlements within the segments they have been granted access to. This includes the ability to name, describe, create, configure, and maintain roles and entitlements that fall within their assigned scope. More details are available in the SailPoint Data Segmentation documentation: Data Segmentation Overview - SailPoint Identity Services.

5

This is not foolproof, but might work as a compromise between security and getting the work done

  1. Using JDBC Buildmap rule, encrypt the DOB. (Securely storing and using of encryption key in this step is crucial.)
  2. Same encrypted value is written to Identity attribute
  3. Create a Interactive Trigger Workflow that can call a Powershell script and pass the DOB identity attribute.
  4. Powershell script will decrypt the string and return the DOB (sing the same key as in Step 1)
  5. Limit the access to the Launcher to users who are authorised to view the DoB.