STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

MarkLogic Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.

DISA Rule

SV-220376r961275_rule

Vulnerability Number

V-220376

Group Title

SRG-APP-000314-DB-000310

Rule Version

ML09-00-006500

Severity

CAT II

CCI(s)

• CCI-002264 - Provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in transmission.

Weight

10

Fix Recommendation

See specific MarkLogic documentation regarding Compartment level security for necessary steps.

Applying Document Compartment Security:
1. Navigate to the MarkLogic Admin page >> Security >> Roles.
2. Create a new role and assign applicable roles/permissions.
3. Provide a Compartment name to the role.
4. Ensure all data ingestion mechanisms (i.e., document insertion code/logic) apply the necessary applicable security permissions.

Applying Element-Level Security:
1. Navigate to the MarkLogic Admin page >> Security >> Protected Paths.
2. Create a Protected Path by specifying an XQuery path expression identifying the element requiring specific protections.
3. Add one or more applicable roles and specify their capability then save the configuration.
4. Repeat step 3 for each element requiring additional protections.

Check Contents

MarkLogic supports role-based access control for all entities/documents maintained within the database. User roles and applied document permissions determine access.

For example, if a document has read permission for role1 and read permission for role2, a user who possesses either role1 or role2 can read that document. Permissions in this example are evaluated using "OR" semantics.

Adding a Compartment to a role ensures access controls are evaluated using "AND" semantics when determining user access to a given resource. This security level is applied to the entire document/resource.

1. Verify applicable roles are configured with the necessary access Compartments for the specified role.
2. Verify all documents inserted into the MarkLogic database have the applicable permission (Compartment) applied.

If applicable roles do not have Compartments defined, this is a finding.

If documents inserted into the database do not have the applicable document permissions (Compartments) applied, this is a finding.

Additionally, MarkLogic can enforce Element-Level Security and Element Redaction ensuring users can only access specific elements of information they are permitted to access. Data a user is not permitted to see may be redacted or excluded all together.

Element-Level Security also ensures document searches do not return results where the search value is within an Element to which the user does not have access. This security level is applied to specified elements within a given document.

When/where applicable:
1. Navigate to the MarkLogic Admin page >> Security >> Protected Paths.
2. Verify the applicable elements requiring additional protections are defined using an XQuery path expression (applicable for both XML and JSON document types).
3. Verify the applicable role(s) are added against the specified path expression.

If specific document elements require additional protections and no Protected Paths or Protect Path roles are defined, this is a finding.

Vulnerability Number

V-220376

Documentable

False

Rule Version

ML09-00-006500

Severity Override Guidance

MarkLogic supports role-based access control for all entities/documents maintained within the database. User roles and applied document permissions determine access.

For example, if a document has read permission for role1 and read permission for role2, a user who possesses either role1 or role2 can read that document. Permissions in this example are evaluated using "OR" semantics.

Adding a Compartment to a role ensures access controls are evaluated using "AND" semantics when determining user access to a given resource. This security level is applied to the entire document/resource.

1. Verify applicable roles are configured with the necessary access Compartments for the specified role.
2. Verify all documents inserted into the MarkLogic database have the applicable permission (Compartment) applied.

If applicable roles do not have Compartments defined, this is a finding.

If documents inserted into the database do not have the applicable document permissions (Compartments) applied, this is a finding.

Additionally, MarkLogic can enforce Element-Level Security and Element Redaction ensuring users can only access specific elements of information they are permitted to access. Data a user is not permitted to see may be redacted or excluded all together.

Element-Level Security also ensures document searches do not return results where the search value is within an Element to which the user does not have access. This security level is applied to specified elements within a given document.

When/where applicable:
1. Navigate to the MarkLogic Admin page >> Security >> Protected Paths.
2. Verify the applicable elements requiring additional protections are defined using an XQuery path expression (applicable for both XML and JSON document types).
3. Verify the applicable role(s) are added against the specified path expression.

If specific document elements require additional protections and no Protected Paths or Protect Path roles are defined, this is a finding.

Check Content Reference

M

Target Key

4064