Mask a dataset and then try to re-identify it

short · 50 min · Objective 1.6

Task

Produce a masked copy of a small dataset, then attack your own masking with plausible outside knowledge. The re-identification is the lesson.

Steps

  1. Write lab/data/source.csv with 200 generated rows including at least three quasi-identifiers and one sensitive attribute.
  2. Produce lab/data/masked.csv by replacing direct identifiers with realistic false values, preserving referential integrity and the distribution of the sensitive attribute.
  3. Write lab/data/reident.sh that counts how many rows are UNIQUE on the combination of quasi-identifiers alone.
  4. Run it. Record the number of uniquely identifiable rows in lab/data/reident.md.
  5. Generalise one quasi-identifier -- truncate the area code, bucket the date of birth to a year or a decade -- re-run, and record the new number and the analytical value you lost.

Verify

wc -l < lab/data/source.csv
wc -l < lab/data/masked.csv
sh lab/data/reident.sh
grep -Ec '[0-9]+' lab/data/reident.md

Both files 200 rows, and the re-identification count recorded BEFORE and AFTER generalisation, with the second lower. If the first count was zero, your quasi-identifiers are too coarse to be realistic -- real data is far more identifying than generated data usually is.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.