foreign and welcome to part six in this series about securing fields in servicenow in this video we're going to take a look at a brand new feature in the Tokyo release called Data anonymization data anonymization is intended to secure or anonymize data that is cloned or copied over from your production instance to a non-production instance when your cloning instances in servicenow you have certain control over what tables and what records in those tables are copied using data preservers and excluded data records but what you don't have up until now is a way in which you can specify What fields are actually copied over when you do a clone the selected records in the selected tables are copied over without any exceptions now you may want to anonymize some of that data some of that data may be sensitive or maybe personally identifiable for example if you copy users over to a non-production instance you may want to exclude address data phone numbers Etc you may not need that data in your non-production instance moreover it may not just be a question of what data you need but what data you are permitted to have there may be data privacy and laws that govern what data you're allowed to keep in certain locations data anonymizations kind of sits between having rate access to a field and not having read access to a field what do I mean by that well if you're a user that's been granted an access control rule that gives you read access to a field you'll still be able to see that field but the data that you see in that field will not be the original value it will have been anonymized in other words the original value has been replaced either with asterisks or random characters or something else entirely it's important to note that data anonymization is not data encryption we're going to talk about data encryption in the next video with data anonymization we are actually replacing values of fields in the database itself my intention with this video is simply to provide an overview of this feature I strongly recommend that for all of you who want to learn more about data anonymization to take the course on it in our learning now there are four steps to anonymizing data step one we have to create a data class in other words what kind of data are we dealing with is it personally identifiable data or are we dealing with secret codes for devices that need to be hidden step two we need to classify certain Fields according to that classification that we've created step three we need to create a data privacy policy configuration in other words how are we going to anonymize that data what method are we going to use for that and fourth and lastly we need to run a data privacy job so without any further Ado let's get straight into an example okay so for this example we're going to use the same table that we've been using in previous videos this cars table here and in previous examples we've been looking at ways in which we can secure or maybe not so this field right here the pen field okay so I'm currently logged in as the cars user and not only can I see this field I can also change it okay and the same also applies to the car's admin user who has the similar right to do that here let's just say that they are secret codes they should only be viewable by certain users in the production instance of servicenow No One In A non-production instance of servicenow needs to know these real codes so we need to find a way to replace these values with something else okay so the first thing that we need to do is to create a data classification so I'm going to come over to another tab here and I'm going to go under system security data classification go to data classes you can see some of the ones here that have been provided by a servicenow out of the box personally identifiable information privacy confidential Etc okay I'm going to create a custom data class here so click on new here and we'll just call this one security codes or security code singular okay let's say we just need a way to classify any data we've got in our instance as a security code if it is in fact a security code okay so I will put in a description always best practice security codes for vehicles okay and save that okay the next step is that we actually need to now classify that pin as a security code class so the way in which we do that we need to come to the dictionary entry or the list actually for these fields and we search for that pin field this is it right here and now in the list context menu there is an option there to classify that field so I'll come here and select classify and then specify that security code entry that we've just created okay and click on classify all right so now that pin field has been classified as a security code field all right the next step now is to create a data privacy policy configuration so let's come here to data privacy policy configuration now what I've done already what I haven't shown you is that I've elevated to certain roles in order to be able to see these modules here okay so if you look at the training course in our learning on this it goes through the different roles that are available in this application but I can already show you here if I come to elevate roll there there are various data privacy roles that you need to be able to do the configuration that I'm showing you here okay all right so let's go to privacy policy configuration and let's go ahead and create a new one and we'll just call this one cars pin and now we can apply it to a specific data classification data class the one that we created earlier so there's security code which then as we've seen is now applying to the pin field but it could also just as well apply to other fields in our instance as well other security code other pen fields in other tables okay but at the moment we've only applied it to one field in one table okay all right I'm going to apply this to all records in that class okay in the class that we've defined here if you leave this unselected here there is actually a way in which you can then select uh specific users that should whose data should be anonymized but we're not dealing with user data here so we can just leave that there is also an option to apply this configuration when you're cloning okay but I'll leave that unchecked all right so I will go ahead and save this record and after we do that we can see what Fields have been pulled according to that data class at the moment we only classified one field in one table with the security code data class and that is what appears here now what we do need and we get a message up here saying um that this field or this privacy configuration actually lacks an Associated anonymization technique okay so you can see here in this related list we've got this empty field value here for privacy technique configuration now this field here actually references another table we can look at this quickly here privacy technique configuration these are the ones that servicenow provides out of the box but you can create your own but you've got some basic ones here such as to remove the field value entirely to replace the value with an Asterix or with some random characters Etc all right so let's go back and I will just select the option to replace the string with Asterix so I'll just come here to open the record and I will provide that selective replace with Asterix okay so that's just going to replace all the characters in the pin with a series of asterisks okay and update that okay and now the final step is to create a data privacy job so let's go ahead and do that and run it and let the system do its work so I'll create a new record here and we'll call this the same thing uh cars pin oops and anonymize or pins for all cars okay and then we will specify that privacy configuration that we just came from uh you can select dry one dry run rather to see how many records will be affected by this but I will deselect that by the way once you do run this there is an option to roll back by default you've got the option to do that three days after you've run the data anonymization job so for some reason you want to roll back to the original values you can do that okay so we'll go ahead and select a time for this job to start at the moment it's 15 49 where I am so I'll put in here 15.50 and 1551 and save that and then I'll just go ahead and schedule that job okay so now you can see once that time uh ticked over um we actually processed a thousand rows we have a thousand records in that table so we get a little log entry here uh the fact that it's been completed so let's test this out now and we can see the pin values have been changed to asterisks now and if I go to the cars user session here and do the same thing obviously we're going to see the same anonymized values here as for the car's admin and there we go okay now as I mentioned earlier in this video data anonymization is not the same as data encryption okay these are not encrypted values these are actually hard-coded values these are the values that we actually see in the database okay and we haven't changed any access control rules so I had write access before I've got right access now which means I can actually come in here and change these values to something else okay that will work okay but it means now that those secret codes those security codes from the production instance once we've performed that clone onto a non-production instance we are no longer able to see those values so that ladies and gentlemen is how you anonymize data now if we go back to our admin session here and go back to that data privacy job let me just refresh the form here now we've got the rollback option okay as I said by default that's available for three days you can change that I think virus system property but if I were to click on that well guess what's going to happen we're going to roll back to those original values that we had have been cloned over from our production instance okay so if I come back now to the list and just refresh it at the moment we've got a whole bunch of asterisks but now we see the original values except for that one that's been changed earlier okay so just pay attention to that okay everyone so that is a short overview of data anonymization just a couple of notes before we wrap up remember data anonymization is not a permanent State as we just saw they are run as individual jobs and after the job has been completed if the user still has right access to that field well guess what they can change those values data anonymization is not the same as data encryption okay so the values that we anonymized or the new values that we have now they are the values that exist in the database so if you have flows and scripts and other processes going on in the background that are checking for those values in the background well they're going to be checking those hard-coded anonymized values now instead of the original values and as we just saw we can roll back those changes we have that option for a few days after okay so I hope you found this video helpful again I just want to repeat that this is just a short overview there is a course an e-learning course on now learning that goes into a lot more detail in data anonymization so I would strongly recommend that if you want to learn more about this feature that you take that course so stay tuned for the next video in this series where we will look at data encryption so thanks for watching and see you next time