DataTerminology.comNEW
Also known as: CLS
A security control that restricts access to specific columns of a table to protect sensitive fields.
DESCRIPTION
Column-level security limits exposure of sensitive fields like PII by controlling read permissions per column. It is implemented via grants, masking policies, or views. Vendors provide dynamic data masking and policy functions to tailor visibility. CLS complements row-level security and encryption to achieve defense-in-depth. Proper privilege design and auditing prevent leakage through derived columns or joins.
ALTERNATIVE DEFINITIONS
Microsoft Learn
Column permissions let you grant or deny access to specific columns in a table.
Explicitly describes column-scoped permission semantics.
Snowflake Documentation
Column-level security enables masking and protecting sensitive data in specific columns using policies.
Emphasizes masking policies for column protection.
PostgreSQL Documentation
Privileges can be granted on columns to allow fine-grained control over table access.
Focuses on column-level privileges built into SQL.
RELATED TERMS
RBAC Attribute-Based Access Control Data Masking IAM Data Encryption Access Control List Database Security
COMPETING TERMS
RELATIONS
- Broader: Security
KNOWLEDGE AREAS
Data Security Data Management Data Architecture Data Storage & Operations
TARGET AUDIENCE
Data Engineer Analytics Engineer Data Steward Data Architect Cloud Architect BI Specialist Data Governance Manager
EXTERNAL SOURCES
- Wikipedia - Database security
- Snowflake - Column security and masking policies
- PostgreSQL - Column privilege capabilities
- Microsoft - SQL Server permissions reference
TOP QUESTIONS
When should Column-Level Security be used?
Use CLS to protect sensitive fields like PII and PHI while allowing broader table access to non-sensitive columns.
Category: Requirements
How does Column-Level Security differ from Row-Level Security?
CLS hides specific columns; RLS filters rows. Together they enable fine-grained protection across data dimensions.
Category: Alternatives
What are common mistakes with Column-Level Security?
Relying only on views without restricting base table access and forgetting derived fields can lead to leaks.
Category: Mistakes
How is Column-Level Security implemented in SQL databases?
Using GRANT/DENY on columns, masking policies, and secure views to limit exposure.
Category: Example
What risks arise if Column-Level Security is misconfigured?
Sensitive data may be exposed through joins, functions, or logs if permissions and masking are incomplete.
Category: Risks
Does Column-Level Security impact performance?
Minimal overhead generally, but complex masking functions or view layering can add costs.
Category: Opinion
How to audit Column-Level Security effectiveness?
Review privilege grants, query logs, and test access paths to ensure policies hold across tools.
Category: Management
Is Column-Level Security enough for compliance?
It’s necessary but not sufficient; combine with encryption, RLS, and governance processes for compliance.
Category: Relevancy
Can Column-Level Security be dynamic?
Yes, with dynamic masking policies that depend on user roles or attributes.
Category: Example