Home
Security Hardening
DISA STIG MongoDB Enterprise Advanced 3.x V1R2

DISA STIG MongoDB Enterprise Advanced 3.x V1R2

MD3X-00-000340 – If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords – mode
Details The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used...
MD3X-00-000340 – If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords – PEMKeyFile
Details The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used...
MD3X-00-000360 – MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB – CAFile
Details The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder...
MD3X-00-000360 – MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB – PEMKeyFile
Details The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder...
MD3X-00-000370 – MongoDB must map the PKI-authenticated identity to an associated user account.
Details The DoD standard for authentication is DoD-approved PKI certificates. Once a PKI certificate has been validated, it must be...
MD3X-00-000270 – The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.
Details If MongoDB were to allow any user to make changes to database structure or logic, then those changes might...
MD3X-00-000380 – MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.
Details Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect...
MD3X-00-000280 – Unused database components, DBMS software, and database objects must be removed.
Details Information systems are capable of providing a wide variety of functions and services. Some of the functions and services,...
MD3X-00-000390 – MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
Details Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization...
MD3X-00-000290 – Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled – enabled
Details Information systems are capable of providing a wide variety of functions and services. Some of the functions and services,...

Prev Next

DISA STIG MongoDB Enterprise Advanced 3.x V1R2

MD3X-00-000340 – If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords – mode

MD3X-00-000340 – If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords – PEMKeyFile

MD3X-00-000360 – MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB – CAFile

MD3X-00-000360 – MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB – PEMKeyFile

MD3X-00-000370 – MongoDB must map the PKI-authenticated identity to an associated user account.

MD3X-00-000270 – The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.

MD3X-00-000380 – MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.

MD3X-00-000280 – Unused database components, DBMS software, and database objects must be removed.

MD3X-00-000390 – MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

MD3X-00-000290 – Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled – enabled