II - Mission Support Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000266-DB-000162
Group -
MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of er...Rule Medium Severity -
SRG-APP-000267-DB-000163
Group -
MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.
If MongoDB provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully con...Rule Medium Severity -
SRG-APP-000311-DB-000308
Group -
MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.
Without the association of security labels to information, there is no basis for MongoDB to make security-related access-control decisions. Security labels are abstractions representing the basic ...Rule Medium Severity -
SRG-APP-000328-DB-000301
Group -
MongoDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.
Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in which...Rule Medium Severity -
SRG-APP-000356-DB-000314
Group -
MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.
Without the ability to centrally manage the content captured in the audit records, identification, troubleshooting, and correlation of suspicious behavior would be difficult and could lead to a del...Rule Medium Severity -
SRG-APP-000357-DB-000316
Group -
MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.
In order to ensure sufficient storage capacity for the audit logs, MongoDB must be able to allocate audit record storage capacity. Although another requirement (SRG-APP-000515-DB-000318) mandates t...Rule Medium Severity -
SRG-APP-000359-DB-000319
Group -
MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.
Organizations are required to use a central log management system, so, under normal conditions, the audit space allocated to MongoDB on its own server will not be an issue. However, space will stil...Rule Medium Severity -
SRG-APP-000378-DB-000365
Group -
MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.
Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escal...Rule Medium Severity -
SRG-APP-000380-DB-000360
Group -
MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).
Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. When dealing with access restrictions pe...Rule Medium Severity -
SRG-APP-000389-DB-000372
Group -
MongoDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
The DoD standard for authentication of an interactive user is the presentation of a Common Access Card (CAC) or other physical token bearing a valid, current, DoD-issued Public Key Infrastructure (...Rule Medium Severity -
SRG-APP-000400-DB-000367
Group -
MongoDB must prohibit the use of cached authenticators after an organization-defined time period.
If cached authentication information is out-of-date, the validity of the authentication information may be questionable.Rule Medium Severity -
SRG-APP-000427-DB-000385
Group -
MongoDB must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.
Only DoD-approved external PKIs have been evaluated to ensure that they have security controls and identity vetting procedures in place which are sufficient for DoD systems to rely on the identity ...Rule Medium Severity -
SRG-APP-000428-DB-000386
Group -
MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
DBMSs handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic mec...Rule Medium Severity -
SRG-APP-000441-DB-000378
Group -
MongoDB must maintain the confidentiality and integrity of information during preparation for transmission.
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, an...Rule Medium Severity -
SRG-APP-000442-DB-000379
Group -
MongoDB must maintain the confidentiality and integrity of information during reception.
Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points, and during packing/un...Rule Medium Severity -
SRG-APP-000447-DB-000393
Group -
When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.
A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information syst...Rule Medium Severity -
SRG-APP-000178-DB-000083
Group -
MongoDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
The DoD standard for authentication is DoD-approved PKI certificates. Normally, with PKI authentication, the interaction with the user for authentication will be handled by a software component se...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
MongoDB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.
Configuring MongoDB to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across...Rule Medium Severity -
SRG-APP-000456-DB-000400
Group -
MongoDB products must be a version supported by the vendor.
Unsupported commercial and database systems should not be used because fixes to newly identified bugs will not be implemented by the vendor. The lack of support can result in potential vulnerabilit...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.