STIGQter: STIG Summary: MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

DISA Rule

SV-96633r1_rule

Vulnerability Number

V-81919

Group Title

SRG-APP-000428-DB-000386

Rule Version

MD3X-00-000740

Severity

CAT II

CCI(s)

• CCI-002475 - The information system implements cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.

Weight

10

Fix Recommendation

Configure MongoDB to use the Encrypted Storage Engine and a KMIP appliance as documented here:

https://docs.mongodb.com/v3.4/core/security-encryption-at-rest/
https://docs.mongodb.com/v3.4/tutorial/configure-encryption/

Check Contents

Review the documentation and/or specification for the organization-defined information.

If any data is PII, classified or is deemed by the organization to be encrypted at rest, this is a finding.

Verify the mongod command line contain the following options:

--enableEncryption
--kmipServerName <KMIP Server HostName>
--kmipPort <KMIP server port>
--kmipServerCAFile ca.pem
--kmipClientCertificateFile client.pem

If these above options are not part of the mongod command line, this is a finding.

Items in the <> above and starting with kmip* are specific to the KMIP appliance and need to be set according to the KMIP appliance configuration.

Vulnerability Number

V-81919

Documentable

False

Rule Version

MD3X-00-000740

Severity Override Guidance

Review the documentation and/or specification for the organization-defined information.

If any data is PII, classified or is deemed by the organization to be encrypted at rest, this is a finding.

Verify the mongod command line contain the following options:

--enableEncryption
--kmipServerName <KMIP Server HostName>
--kmipPort <KMIP server port>
--kmipServerCAFile ca.pem
--kmipClientCertificateFile client.pem

If these above options are not part of the mongod command line, this is a finding.

Items in the <> above and starting with kmip* are specific to the KMIP appliance and need to be set according to the KMIP appliance configuration.

Check Content Reference

M

Target Key

3265

Comments