LESIS Bulletin #6 - PII masking, secure identifier sharing and AWS monitoring

Introduction

This month, we explore practical approaches to reducing the exposure of personal data, discuss how organizations can compare identifiers without sharing more information than necessary, and highlight an open-source tool for continuous security monitoring across AWS environments.

Research & Articles

Orientations for PII obfuscation and masking

Personally identifiable information appears across application interfaces, logs, support tools, reports, notifications, and non-production environments. When the full value is not necessary for a specific task, masking can help reduce unnecessary exposure.

This article presents practical guidelines for consistently masking fields such as email addresses, phone numbers, CPF numbers, IP addresses, document numbers, vehicle plates, and device identifiers. It also explains the differences between masking, obfuscation, anonymization, encryption, and hashing, which address distinct security and privacy requirements.

A central concern is inconsistency. When different systems reveal different parts of the same identifier, those fragments may be combined to reconstruct the original value. For this reason, masking should be treated as a shared security policy rather than a formatting decision made independently by each application.

The article recommends centralized masking rules, reusable libraries, secure behavior for malformed or unusually short values, and testing masking logic as a security-relevant component. Masking supports data minimization, but it does not replace access control, encryption, retention limits, auditing, or secure deletion.

Choosing the right method for sharing identifiers

Business partnerships sometimes require organizations to compare customer bases or determine user eligibility without exposing complete datasets.

This article examines a scenario in which a financial institution and a marketplace need to identify shared customers for a promotional campaign. Although sending an encrypted file would protect the identifiers during transmission, the legitimate recipient would still gain access to the complete dataset after decrypting it.

The article compares different approaches, including encryption, simple hashes, HMAC-based designs, controlled APIs, and private set intersection. It explains why predictable identifiers such as CPF numbers should not be protected using simple hashes alone, since their limited and structured input space makes enumeration and precomputation attacks possible.

The main lesson is that secure transmission and data minimization are different objectives. The appropriate solution depends on what each organization needs to learn, which party controls the keys or comparison process, how queries are audited, and whether the result can be represented as an eligibility flag rather than another list of personal identifiers.

Tool Spotlight

Calibre — Continuous security monitoring for AWS environments

Calibre is an open-source tool developed to continuously identify security issues across AWS environments using Steampipe’s query-driven capabilities.

The tool can execute predefined security checks across multiple AWS accounts, helping organizations centralize cloud security assessments and monitor compliance-related conditions. Security queries are defined through YAML files, making the checks easier to organize, customize, and extend.

Calibre includes more than 30 pre-built queries, including reconnaissance checks for attack-surface mapping. It can generate either a consolidated report containing all executed queries or separate reports for each individual check.

Teams can also create their own rules for AWS services and resources, allowing Calibre to support security requirements that are specific to their infrastructure, operational context, or internal standards.

The project is open source and available for use and contribution.

Community

​

LESIS at GRIS Week

We also supported GRIS Week, which took place from August 17 to 21 at UFRJ.

The event brought together students and cybersecurity enthusiasts for a week of talks, practical activities, and technical discussions covering different areas of information security. On the last day, a CTF competition was held, closing the week with a hands-on challenge for the participants.

It was great to join the community, follow the sessions, exchange experiences, and contribute to another space dedicated to cybersecurity learning and collaboration.

Closing

LESIS is an applied security research entity focused on developing effective offensive technologies in support of critical operations. Its approach is grounded in a thorough attacker’s perspective and rigorous, research-driven thinking

If you found this issue interesting, feel free to share it with colleagues working in security research.
​