STIGQter STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

MarkLogic Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

DISA Rule

SV-220387r1018556_rule

Vulnerability Number

V-220387

Group Title

SRG-APP-000428-DB-000386

Rule Version

ML09-00-008500

Severity

CAT I

CCI(s)

Weight

10

Fix Recommendation

Configure MarkLogic to provide the required level of cryptographic protection.

Perform the fix from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.

1. Click the Databases icon.
2. Click the database that is to be fixed.
3. Select ON from the data encryption drop-down.

Check Contents

Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from modification, which must include, at a minimum, PII and classified information.

If no information is identified as requiring such protection, this is not a finding.

Review system settings to determine if any of the information defined as requiring cryptographic protection from modification, is not encrypted in a manner that provides the required level of protection.

Perform the check from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.

1. Click the Databases icon.
2. Click the database that is to be checked.
3. If the "data encryption" drop-down is set to ON, this is not a finding, and no further checks need to be performed.
4. If the "data encryption" drop-down is set to OFF, continue the check.
5. If the "data encryption" drop-down is set to default-cluster, continue the check with the steps below:
a. Click on the Clusters icon.
b. Click [Cluster Name].
c. Click the Keystore Tab.
d. If the Cluster Default Encryption configuration is OFF, this is a finding.

Findings Matrix
-------------------------------------------------------
Database Cfg. | Cluster Cfg | Finding
--------------------------------------------------------
ON | *Any* | No
*Any* | Force | No
Default-cluster | Default-on | No
Default-cluster | Default-off | Yes
Off | Default-on | Yes
Off | Default-off | Yes

Vulnerability Number

V-220387

Documentable

False

Rule Version

ML09-00-008500

Severity Override Guidance

Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from modification, which must include, at a minimum, PII and classified information.

If no information is identified as requiring such protection, this is not a finding.

Review system settings to determine if any of the information defined as requiring cryptographic protection from modification, is not encrypted in a manner that provides the required level of protection.

Perform the check from the MarkLogic Server Admin Interface with a user that holds administrative-level privileges.

1. Click the Databases icon.
2. Click the database that is to be checked.
3. If the "data encryption" drop-down is set to ON, this is not a finding, and no further checks need to be performed.
4. If the "data encryption" drop-down is set to OFF, continue the check.
5. If the "data encryption" drop-down is set to default-cluster, continue the check with the steps below:
a. Click on the Clusters icon.
b. Click [Cluster Name].
c. Click the Keystore Tab.
d. If the Cluster Default Encryption configuration is OFF, this is a finding.

Findings Matrix
-------------------------------------------------------
Database Cfg. | Cluster Cfg | Finding
--------------------------------------------------------
ON | *Any* | No
*Any* | Force | No
Default-cluster | Default-on | No
Default-cluster | Default-off | Yes
Off | Default-on | Yes
Off | Default-off | Yes

Check Content Reference

M

Target Key

4064