Skip to content
ATO Pathways
  Log In

I - Mission Critical Classified

Rules and Groups employed by this XCCDF Profile

  • SRG-APP-000266-DB-000162

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

    &lt;VulnDiscussion&gt;Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromis...
    Rule Medium Severity
    Show

  • SRG-APP-000267-DB-000163

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

    &lt;VulnDiscussion&gt;If MongoDB provides too much information in error logs and administrative messages to the screen, this could lead to compromi...
    Rule Medium Severity
    Show

  • SRG-APP-000311-DB-000308

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.

    &lt;VulnDiscussion&gt;Without the association of security labels to information, there is no basis for MongoDB to make security-related access-cont...
    Rule Medium Severity
    Show

  • SRG-APP-000328-DB-000301

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

    &lt;VulnDiscussion&gt;Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have di...
    Rule Medium Severity
    Show

  • SRG-APP-000356-DB-000314

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.

    &lt;VulnDiscussion&gt;Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and corre...
    Rule Medium Severity
    Show

  • SRG-APP-000357-DB-000316

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

    &lt;VulnDiscussion&gt;In order to ensure sufficient storage capacity for the audit logs, MongoDB must be able to allocate audit record storage capa...
    Rule Medium Severity
    Show

  • SRG-APP-000359-DB-000319

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

    &lt;VulnDiscussion&gt;Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to ...
    Rule Medium Severity
    Show

  • SRG-APP-000378-DB-000365

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

    &lt;VulnDiscussion&gt;Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malici...
    Rule Medium Severity
    Show

  • SRG-APP-000380-DB-000360

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

    &lt;VulnDiscussion&gt;Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the o...
    Rule Medium Severity
    Show

  • SRG-APP-000389-DB-000372

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

    &lt;VulnDiscussion&gt;The DoD standard for authentication of an interactive user is the presentation of a Common Access Card (CAC) or other physica...
    Rule Medium Severity
    Show

  • SRG-APP-000400-DB-000367

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must prohibit the use of cached authenticators after an organization-defined time period.

    &lt;VulnDiscussion&gt;If cached authentication information is out-of-date, the validity of the authentication information may be questionable.&lt;/...
    Rule Medium Severity
    Show

  • SRG-APP-000427-DB-000385

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

    &lt;VulnDiscussion&gt;Only DoD-approved external PKIs have been evaluated to ensure that they have security controls and identity vetting procedure...
    Rule Medium Severity
    Show

  • SRG-APP-000428-DB-000386

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

    &lt;VulnDiscussion&gt;DBMSs handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclos...
    Rule Medium Severity
    Show

  • SRG-APP-000441-DB-000378

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must maintain the confidentiality and integrity of information during preparation for transmission.

    &lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including...
    Rule Medium Severity
    Show

  • SRG-APP-000442-DB-000379

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must maintain the confidentiality and integrity of information during reception.

    &lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, duri...
    Rule Medium Severity
    Show

  • SRG-APP-000447-DB-000393

    <GroupDescription></GroupDescription>
    Group
    Show

  • When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.

    &lt;VulnDiscussion&gt;A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or uni...
    Rule Medium Severity
    Show

  • SRG-APP-000178-DB-000083

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

    &lt;VulnDiscussion&gt;The DoD standard for authentication is DoD-approved PKI certificates. Normally, with PKI authentication, the interaction wit...
    Rule High Severity
    Show

  • SRG-APP-000516-DB-000363

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.

    &lt;VulnDiscussion&gt;Configuring MongoDB to implement organization-wide security implementation guides and security checklists ensures compliance ...
    Rule Medium Severity
    Show

  • SRG-APP-000456-DB-000400

    <GroupDescription></GroupDescription>
    Group
    Show

  • MongoDB products must be a version supported by the vendor.

    &lt;VulnDiscussion&gt;Unsupported commercial and database systems should not be used because fixes to newly identified bugs will not be implemented...
    Rule High Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules