MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000224-DB-000384
Group -
MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.
One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. The preferred technique fo...Rule Medium Severity -
SRG-APP-000231-DB-000154
Group -
MongoDB must protect the confidentiality and integrity of all information at rest.
This control is intended to address the confidentiality and integrity of information at rest in nonmobile devices and covers user information and system information. Information at rest refers to t...Rule High Severity -
SRG-APP-000243-DB-000128
Group -
SRG-APP-000251-DB-000160
Group -
MongoDB must check the validity of all data inputs except those specifically identified by the organization.
Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application is unprepared to process that data. This results in unanticipated applic...Rule Medium Severity -
SRG-APP-000251-DB-000391
Group -
MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000266-DB-000162
Group -
MongoDB must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of er...Rule Medium Severity -
SRG-APP-000267-DB-000163
Group -
SRG-APP-000295-DB-000305
Group -
The DBMS must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
This addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). ...Rule Medium Severity -
SRG-APP-000311-DB-000308
Group -
MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.
Without the association of security labels to information, there is no basis for MongoDB to make security-related access-control decisions. Security labels are abstractions representing the basic ...Rule Medium Severity -
SRG-APP-000328-DB-000301
Group -
MongoDB must enforce discretionary access control (DAC) policies, as defined by the data owner, over defined subjects and objects.
DAC is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which mode (e.g., read or write). Ow...Rule Medium Severity -
SRG-APP-000340-DB-000304
Group -
When updates are applied to MongoDB software, any software components that have been replaced or made unnecessary must be removed.
Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some DBMSs' installation tools may remove o...Rule Medium Severity -
SRG-APP-000357-DB-000316
Group -
MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.
In order to ensure sufficient storage capacity for the audit logs, MongoDB must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates t...Rule Medium Severity -
SRG-APP-000359-DB-000319
Group -
MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.
Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to MongoDB on its own server will not be an issue. However, space will stil...Rule Medium Severity -
SRG-APP-000360-DB-000320
Group -
MongoDB must provide an immediate real-time alert to appropriate support staff of all audit log failures.
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impe...Rule Medium Severity -
SRG-APP-000378-DB-000365
Group -
SRG-APP-000380-DB-000360
Group -
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. When dealing with access restrictions pe...Rule Medium Severity -
SRG-APP-000383-DB-000364
Group -
The DBMS must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.
Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.Rule Medium Severity -
SRG-APP-000416-DB-000380
Group -
SRG-APP-000427-DB-000385
Group -
MongoDB must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.
Only DOD-approved external PKIs have been evaluated to ensure that they have security controls and identity vetting procedures in place which are sufficient for DOD systems to rely on the identity ...Rule Medium Severity -
SRG-APP-000428-DB-000386
Group -
SRG-APP-000456-DB-000400
Group -
SRG-APP-000441-DB-000378
Group -
MongoDB must maintain the confidentiality and integrity of information during preparation for transmission.
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, an...Rule Medium Severity -
SRG-APP-000442-DB-000379
Group -
MongoDB must maintain the confidentiality and integrity of information during reception.
Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points, and during packing/un...Rule Medium Severity -
SRG-APP-000447-DB-000393
Group -
When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.
A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information syst...Rule Medium Severity -
SRG-APP-000454-DB-000389
Group -
SRG-APP-000515-DB-000318
Group -
MongoDB must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for standalone systems.
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. T...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
MongoDB must be configured in accordance with the security configuration settings based on DOD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.
Configuring MongoDB to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across...Rule Medium Severity -
SRG-APP-000456-DB-000390
Group -
SRG-APP-000001-DB-000031
Group -
MongoDB must limit the total number of concurrent connections to the database.
Database management includes the ability to control the number of users and user sessions utilizing a DBMS. Unlimited concurrent connections to the DBMS could allow a successful denial-of-service (...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.