MongoDB Enterprise Advanced 4.x Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000121-DB-000202
Group -
MongoDB must protect its audit features from unauthorized access.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may p...Rule Medium Severity -
SRG-APP-000141-DB-000092
Group -
Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizatio...Rule Medium Severity -
SRG-APP-000142-DB-000094
Group -
Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizatio...Rule Medium Severity -
SRG-APP-000172-DB-000075
Group -
If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.
The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and require...Rule High Severity -
SRG-APP-000211-DB-000122
Group -
SRG-APP-000225-DB-000153
Group -
MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Failure to a known secure state helps prevent a loss of confidentiality, ...Rule Medium Severity -
SRG-APP-000243-DB-000373
Group -
MongoDB must prevent unauthorized and unintended information transfer via shared system resources.
The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf...Rule Medium Severity -
SRG-APP-000251-DB-000391
Group -
SRG-APP-000311-DB-000308
Group -
MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage and transmission.
Without the association of security labels to information, there is no basis for MongoDB to make security-related access-control decisions. Security labels are abstractions representing the basic ...Rule Medium Severity -
SRG-APP-000328-DB-000301
Group -
MongoDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.
Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which...Rule Medium Severity -
SRG-APP-000179-DB-000114
Group -
MongoDB must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.
The use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not valid...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.