STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

MarkLogic Server must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-220372r961128_rule

Vulnerability Number

V-220372

Group Title

SRG-APP-000231-DB-000154

Rule Version

ML09-00-005100

Severity

CAT I

CCI(s)

• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Apply appropriate controls to protect the confidentiality and integrity of data at rest in the database.

Perform the fix from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.

1. Click the Databases icon.
2. Click the database to be fixed.
3. Select ON from the data encryption drop-down.

Check Contents

If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.

If full-disk encryption is being used, this is not a finding.

Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II.

Review MarkLogic settings to determine whether controls exist to protect the confidentiality and integrity of data at rest in the database.

Perform the check from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.

1. Click the Databases icon.
2. Click the database to be checked.
3. If the "data encryption" drop-down is set to ON, this is not a finding, and no further checks need to be performed.
4. If the "data encryption" drop-down is set to OFF, continue the check.
5. If the "data encryption" drop-down is set to default-cluster, continue the check with the steps below:
a. Click the Clusters icon.
b. Click [Cluster Name].
c. Click the Keystore Tab.
d. If the Cluster Default Encryption configuration is OFF, this is a finding.

Findings Matrix
-------------------------------------------------------
Database Cfg. | Cluster Cfg | Finding
--------------------------------------------------------
ON | *Any* | No
*Any* | Force | No
Default-cluster | Default-on | No
Default-cluster | Default-off | Yes
Off | Default-on | Yes
Off | Default-off | Yes

Vulnerability Number

V-220372

Documentable

False

Rule Version

ML09-00-005100

Severity Override Guidance

If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding.

If full-disk encryption is being used, this is not a finding.

Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II.

Review MarkLogic settings to determine whether controls exist to protect the confidentiality and integrity of data at rest in the database.

Perform the check from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.

1. Click the Databases icon.
2. Click the database to be checked.
3. If the "data encryption" drop-down is set to ON, this is not a finding, and no further checks need to be performed.
4. If the "data encryption" drop-down is set to OFF, continue the check.
5. If the "data encryption" drop-down is set to default-cluster, continue the check with the steps below:
a. Click the Clusters icon.
b. Click [Cluster Name].
c. Click the Keystore Tab.
d. If the Cluster Default Encryption configuration is OFF, this is a finding.

Findings Matrix
-------------------------------------------------------
Database Cfg. | Cluster Cfg | Finding
--------------------------------------------------------
ON | *Any* | No
*Any* | Force | No
Default-cluster | Default-on | No
Default-cluster | Default-off | Yes
Off | Default-on | Yes
Off | Default-off | Yes

Check Content Reference

M

Target Key

4064