Study Guide
Obfuscation: Steganography, Masking, Tokenisation and De-identification
Four ways of protecting data that are not encryption: hiding that a message exists, showing only part of a value, swapping a value for a meaningless token, and removing what identifies a person, with how each differs from encryption and why de-identified does not mean anonymous.
Lesson 6.12 Cryptography & PKI
Encryption is not the only way to protect data. This lesson works out four other techniques, what each hides and from whom, and when each is the right choice.
Stage: Think
A shop receipt
Think it through
Your shop receipt shows your card number with every digit hidden except the last four. Why show those four, and why hide the rest?
- Hint 1: Who might see the receipt after you?
Show what happens
The last four let you check which card you used; the rest is hidden because nobody reading the receipt needs it. Showing each person only what they need is one of several ways to hide data without encrypting it.
Think it through
Show the answer
Answer: B. That there is a message.
That there is a message at all. Hiding the existence of information is different from hiding what it says.
Stage: Explain
Four techniques at a glance
| Technique | What it does | Can the original be recovered? |
|---|---|---|
| Steganography | Hides the existence of data inside other data | Yes, by anyone who knows where and how to look |
| Data masking | Replaces all or part of a value with substitute characters or fictitious data | Normally not, from the masked copy |
| Tokenisation | Replaces a value with an unrelated token | Only by looking the token up in a protected vault |
| De-identification | Removes or alters what identifies a person | Sometimes, by combining what is left with other data |
Stage: Explain
Steganography
Steganography hides the existence of information inside other, ordinary-looking data.
The word means “covered writing”. Invisible ink between the lines of an innocent letter is steganography. So is a digital photograph whose pixel values have been altered very slightly to carry a hidden message: the picture looks the same to the eye, and the file is an ordinary image file.
The difference from encryption is the goal.
- Encryption hides what a message says. Everyone can see that an encrypted message exists.
- Steganography hides that there is a message at all.
The two are often combined: a message is encrypted first and then hidden, so that it is hard to find and unreadable if found.
Steganography has honest uses, such as invisible watermarks that mark the owner of an image or trace the source of a leak. It also has dishonest ones: smuggling stolen data out of an organisation inside innocent-looking files, or concealing instructions for malware inside images. For a defender, the point to remember is that a file can carry more than it appears to.
Check your understanding
Show the answer
Answer: C. Nothing, unless encrypted.
Nothing, unless the data was also encrypted before it was hidden.
Steganography is not a substitute for encryption. If the method is known or guessed, the hidden data is simply there to be read.
Stage: Predict
Data masking
Data masking replaces all or part of a value with substitute characters, or with realistic but fictitious data, so that the result can be shown or used without exposing the original.
You see it every day. A receipt prints a card number as **** **** **** 4821. A website shows your phone number as 07*** ***123.
Masking follows the principle of least privilege: show each person only what their task needs. A call-centre agent can confirm which card a customer is asking about from four digits; nothing in the agent’s job needs the other twelve.
Think it through
Show the answer
Answer: A. Only the last few digits.
Only the last few digits: enough to confirm the card, and no more, which is least privilege applied to what is shown.
There are two common forms.
- Dynamic masking leaves the stored data unchanged and masks it at the moment it is displayed, according to who is looking. A supervisor may see the full value where an agent sees asterisks.
- Static masking creates a separate, altered copy of a dataset, typically for software testing or training. Names, addresses and account numbers are replaced with realistic fakes, so developers work with data that behaves like the real thing and belongs to nobody.
Check your understanding
Show the answer
Answer: C. Static masking
Static masking: a separate, altered copy with realistic but fictitious values.
With dynamic masking the real value still exists in the database, so the database still needs protecting. With static masking the copy should contain nothing that can be turned back into the original.
Stage: Predict
Tokenisation
Tokenisation replaces a sensitive value with a token: a stand-in that has no mathematical relationship to the original.
Think it through
A shop wants to take repeat payments without ever storing customers’ card numbers. How could it refer to a card it does not hold?
- Hint 1: Who could hold the real number instead?
Show what happens
Store a stand-in that means nothing on its own, and let the payment provider, which holds the real number, look it up when a payment is needed.
A customer pays at a fictional online shop. The card number goes straight to the shop’s payment provider. The provider stores the real number in a heavily protected system called a token vault, generates a random token such as tok_8f2k1q9z, records in the vault which token belongs to which card, and gives the shop the token.
The shop stores only the token. Next month, for a repeat order, the shop sends the token to the provider and asks for a payment. The provider looks the token up in its vault, finds the real card number and charges it.
If the shop’s database is stolen, the thief gets tokens. They are useless anywhere else: there is nothing to decrypt, because the tokens were never derived from the card numbers.
The security of tokenisation rests entirely on the vault and on who is allowed to ask it questions. It concentrates the risk in one well-defended place and removes it from everywhere else, which is why shops use it to keep card numbers out of their own systems.
Check your understanding
Show the answer
Answer: C. Very little.
Very little: the tokens are useless anywhere else, and there is nothing to decrypt.
Tokenisation is not encryption
Think it through
Show the answer
Answer: A. No, there is no key.
No. A token was never derived from the number; only the vault’s lookup links the two.
They look similar from outside: a sensitive value goes in and something unreadable comes out. The mechanisms are different.
Both replace a card number with something else. Follow each row to see how the original is recovered, and what an attacker would need.
Encryption
The ciphertext is computed from the card number. Whoever has the key can reverse it, anywhere.
- DataCard number
- OperationEncryptKey: an encryption key
- DataCiphertext, derived from the number
- OperationDecryptKey: the same key
- DataCard number
Tokenisation
The token is random. No key reverses it; the only route back is a lookup in the vault.
- DataCard number
- OperationStore in the vault and issue a random tokenKey: none: the token is not derived from the number
- DataToken, kept by the shop
- OperationLook the token up in the vaultKey: none: needs authorised access to the vault
- DataCard number, inside the provider only
A stolen encryption key unlocks every ciphertext it protected, wherever the ciphertext is. A stolen token unlocks nothing without access to the vault.
Do not confuse: Masking, tokenisation, encryption and hashing
- Way back?Masking
- None from the masked value. Part of the value is hidden or replaced for display or testing.**** **** **** 4821
- Way back?Tokenisation
- A lookup in a protected vault. The token is unrelated to the value.tok_8f2k1q9z
- Way back?Encryption
- Decryption with the key. The ciphertext is computed from the value.AES ciphertext
- Way back?Hashing
- None for anyone. A fixed-length digest for detecting change.A SHA-256 digest
Stage: Predict
De-identification and anonymisation
The last technique concerns data about people. Organisations often want to study or share data without exposing the individuals in it.
De-identification means removing or altering the information that identifies individuals. The obvious targets are direct identifiers: names, addresses, email addresses, pupil numbers.
Think it through
Show the answer
Answer: C. Yes, quite easily.
Yes: a date of birth and a postcode together are enough to single out most people.
The difficulty is that people can also be identified indirectly, by a combination of details none of which is a name.
A fictional secondary school is asked by a local newspaper how attendance differs between year groups. An administrator exports every pupil’s attendance record and deletes the name column. Each row still shows the pupil’s date of birth, home postcode, form group and attendance percentage.
Is that anonymous? No. A date of birth and a postcode together are enough to single out most people. Anyone who knows a pupil’s birthday and street, a neighbour or a classmate’s parent, could find that pupil’s row and read their attendance. The data has been de-identified, in the sense that the direct identifier is gone, and the pupils remain re-identifiable.
What the newspaper actually needs is far less: the average attendance for each year group. The school can share five numbers. It should also check for very small groups: if a year group contained only two pupils with a particular characteristic, even an average would reveal something about them, so small counts are suppressed or merged.
Check your understanding
Show the answer
Answer: B. Averages for each year group
The average attendance for each year group: five numbers, not anyone’s record.
Three terms need to be kept apart.
- Pseudonymisation replaces identifiers with codes, and keeps a separate key that links each code back to a person. The school might replace names with random reference numbers and keep the list of which number is which pupil. This is useful protection, and it is reversible by whoever holds the list.
- De-identification is the general process of removing or altering identifiers. How well it works depends on what remains.
- Anonymisation is the result when individuals are no longer identifiable by any means reasonably likely to be used, including by combining the data with other information. It is a high bar and has to be assessed, not assumed.
Do not confuse: De-identified, pseudonymised and anonymised
- De-identified
- Direct identifiers have been removed or altered. Individuals may still be re-identifiable from what remains.
- Pseudonymised
- Identifiers are replaced with codes, and a separately held key can link them back. Still personal data.
- Anonymised
- Individuals can no longer be identified by any means reasonably likely to be used. No longer personal data.
Check your understanding
Show the answer
Answer: A. No: it is pseudonymised.
No: it is pseudonymised. The kept key links each code back to a pupil.
This distinction has legal weight. Under the UK GDPR, personal data is information about an identifiable person. Pseudonymised data is still personal data, and data protection law applies to it in full. Only data that is genuinely anonymous falls outside it. Calling a dataset “anonymised” when it is merely de-identified is a common and serious mistake.
Go deeper Why re-identification keeps succeeding
Research has repeatedly shown that a small number of ordinary attributes is enough to identify most people. Date of birth, postcode and gender together are unique for a large majority of a population. Records of where a person was at a handful of times, or which films they rated, have been matched back to named individuals by comparing them with public information.
The practical lessons are to release the least data that serves the purpose, to prefer aggregated figures to individual records, to generalise details (a year of birth instead of a date, a district instead of a postcode), and to consider what other data a recipient could combine it with.
Stage: Predict
Choosing between them
Think it through
Before reading the list: which technique would you use to let a system refer to a value without holding it, and which to keep a value secret but recover it later?
- Hint 1: Which technique needs a key to get the value back?
Show what happens
Tokenisation for the first; encryption for the second. The list matches each need to a technique.
- To hide the fact that a message exists: steganography, ideally with encryption underneath.
- To let someone see part of a value: masking.
- To let a system refer to a value without holding it: tokenisation.
- To keep a value secret and get it back later with a key: encryption.
- To study or share data about people without exposing them: de-identification, aiming for anonymisation and checking that it has been achieved.
Stage: Explain
Security+ terminology
The CompTIA Security+ SY0-701 exam objectives (objective 1.4) list under Obfuscation: steganography, tokenization and data masking. Objective 3.3 lists masking, tokenization and obfuscation among the methods to secure data. The objectives use the American spelling “tokenization”.
They do not list de-identification, pseudonymisation or anonymisation in objective 1.4; these are data-protection terms that explain what masking and tokenisation can and cannot achieve for personal data.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
Show the answer
Answer: C. An invisible watermark
An invisible watermark, a use of steganography, marking each client’s copy.
Apply it
Show the answer
Answer: A. Yes, it does.
Yes: dynamic masking changes only what is displayed; the full value is still stored.
Apply it
Show the answer
Answer: B. Share the least data, aggregated.
Release the least data that serves the purpose, aggregated where possible, and check whether anyone could still be identified.
Stage: Check
Check your understanding
These questions come from the approved revision bank. They were approved under owner-authorised delegated review: the site owner authorised the review and did not read each question individually.
Show answer
Answer: Steganography hides that a message exists; encryption hides what it says
Steganography hides the existence of information inside other, ordinary-looking data, whereas encryption conceals what a message says. Ciphertext is obviously a protected message; a carrier image looks like any other image. Neither idea is tied to a kind of key or to a state of data.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: Steganography
Steganography hides the existence of information inside other, ordinary-looking data such as an image. Tokenisation replaces a sensitive value with a token, and data masking replaces part of a value with substitute characters. Neither of those hides a message inside something else.
Revision sources: Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: Data masking
Data masking replaces all or part of a value with substitute characters, so that the result can be displayed without exposing the original. The agent sees enough to confirm the card and no more. Tokenisation would replace the whole number with an unrelated token held in a vault.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: Tokenisation
Tokenisation replaces a sensitive value with a token that has no mathematical relationship to it, with the mapping held in a separately protected token vault. The shop can still refer to a card without holding its number. Encryption would compute ciphertext from the number, which the right key could turn back; a random reference is not derived from the number at all. Masking would show part of the real number.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: False
False. A token has no mathematical relationship to the value it replaces, so it cannot be reversed with a key the way ciphertext can be decrypted. The original can be recovered only by looking the token up in the separately protected token vault.
Revision sources: Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: De-identified, but pupils may still be re-identifiable from what remains
De-identification removes or alters direct identifiers, and it does not necessarily make data anonymous, because individuals may still be re-identifiable from what remains. A date of birth, postcode and form group together can single out one pupil. Nothing was replaced by a token, and nothing was encrypted.
Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: True
True. Pseudonymised data, where identifiers are replaced but a key to them is kept, is still personal data. Anyone with the key can restore the names, so the individuals remain identifiable. Anonymisation means individuals are no longer identifiable.
Revision sources: Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Show answer
Answer: Share totals by year group, with small counts suppressed
Sharing aggregated statistics instead of individual records, and suppressing very small counts, reduces the chance that anyone can be singled out. The newspaper’s purpose needs only the totals. Individual records with a name removed, masked or replaced by a number are de-identified at most, and pupils may still be re-identifiable from what remains.
Revision sources: Obfuscation: Steganography, Masking, Tokenisation and De-identification (Supplementary Study Guide explanation)
Study and revision
Practise through the Cryptography & Data Protection topic. Questions cover steganography against encryption, recognising masking and tokenisation, why a token cannot be decrypted, de-identified against anonymised data, pseudonymised data and sharing statistics; four flashcards recall the main points. Most are learning-only. The questions that have been verified against CompTIA Security+ SY0-701 objective 1.4 are also in the Security+ practice track; that does not mean the lesson covers the whole of an objective, and the lesson does not establish practical experience.
Stage: Consolidate
What to remember
- Steganography hides that a message exists; it is not a substitute for encryption.
- Masking shows only part of a value; dynamic masking acts on display, static masking makes an altered copy.
- Tokenisation replaces a value with a stand-in not derived from it; the vault holds the risk.
- Removing names is not anonymisation; pseudonymised data is still personal data.
- Choose by need: hide existence, show part, refer without holding, keep and recover, or share safely.
Key terms
- Obfuscation
Making data harder to understand, find or misuse, without necessarily encrypting it. Steganography, data masking and tokenisation are forms of it.
- Steganography
Hiding the existence of information inside other, ordinary-looking data such as an image.
- Data masking
Replacing all or part of a value with substitute characters or realistic fictitious data, so that it can be displayed or used for testing without exposing the original.
- Tokenisation
Replacing a sensitive value with a token that has no mathematical relationship to it, with the mapping held in a separately protected token vault.
- De-identification
Removing or altering the information that directly identifies individuals in a dataset.
- Pseudonymisation
Replacing identifiers with codes while a separately held key can link the codes back to individuals.
- Anonymisation
Processing data so that individuals can no longer be identified by any means reasonably likely to be used.
Common misunderstandings
A token is not computed from the original value, so no key turns it back. The original is recovered only by a lookup in the token vault.
People can often be re-identified from what remains, such as a date of birth and a postcode. That data is de-identified, not anonymised.
While a key linking the codes to people exists, the individuals are identifiable and the data is still personal data.
Steganography hides that a message exists. It does not make the message unreadable to someone who finds it.
Further reading
- ICO: Anonymisation: the UK regulator’s guidance on anonymisation and pseudonymisation, and when data stops being personal data.
- NIST IR 8053: De-Identification of Personal Information: techniques and the risk of re-identification.
- NIST glossary: steganography: a short definition.
- CompTIA Security+ SY0-701 exam objectives (PDF): objectives 1.4 and 3.3.
Lesson sources and acknowledgements
Sources and scope
- Covered in Session 9 (see the Session 9 Learning Log): steganography, data masking and tokenisation; and de-identification and anonymisation.
- Accuracy qualifications: tokenisation is not equivalent to encryption; de-identification does not necessarily mean anonymisation; pseudonymised data remains personal data.
- Independently checked: the difference between pseudonymisation and anonymisation against the ICO’s anonymisation guidance; de-identification and re-identification against NIST IR 8053; and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence.
- Supplementary explanation: every definition, the summary table, the uses of steganography, dynamic and static masking, the payment-provider example, the encryption and tokenisation comparison, the school attendance example, the three-way distinction, the note on re-identification, the choosing list and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
- Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the receipt and invisible-ink opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
- No practical work is claimed. The shop, the payment provider and the school are fictional, and the token shown is invented. This lesson is not legal advice, and I have not masked, tokenised or anonymised a real dataset as part of it.
Processing data so that individuals can no longer be identified by any means reasonably likely to be used.
Replacing all or part of a value with substitute characters or realistic fictitious data, so that it can be displayed or used for testing without exposing the original.
Removing or altering the information that directly identifies individuals in a dataset.
A piece of information that identifies a person by itself, such as a name, an email address or a pupil number.
Transforming data with a cipher and a key so that it cannot be read without the right key. Decryption reverses it.
Granting users, processes and systems only the access necessary to perform their authorised functions.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
Making data harder to understand, find or misuse, without necessarily encrypting it. Steganography, data masking and tokenisation are forms of it.
Information relating to an identified or identifiable living individual.
Replacing identifiers with codes while a separately held key can link the codes back to individuals.
Working out who a record is about after the direct identifiers have been removed, usually by combining what remains with other information.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
Hiding the existence of information inside other, ordinary-looking data such as an image.
The protected system that records which token stands for which original value. Looking a token up in it is the only way back to the original.
Replacing a sensitive value with a token that has no mathematical relationship to it, with the mapping held in a separately protected token vault.
The UK’s general data-protection law, applied alongside the Data Protection Act 2018, governing how personal data is processed.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.