STIGQter: STIG Summary: MongoDB Enterprise Advanced 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 24 Jul 2020:

MongoDB must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-96597r1_rule

Vulnerability Number

V-81883

Group Title

SRG-APP-000231-DB-000154

Rule Version

MD3X-00-000440

Severity

CAT II

CCI(s)

• CCI-001199 - The information system protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Ensure that the MongoDB Configuration file (default location: /etc/mongod.conf) has the following set:

security:
enableEncryption: "true"

Ensure that any mongod process that contains the option "--enableEcryption" has "true" as its parameter <boolean> value (e.g., "--enableEncryption true").

Stop/start (restart) and mongod process using either the MongoDB configuration file or that contains the "--enableEncryption" option.

Check Contents

If the MongoDB Encrypted Storage Engines is being used, ensure that the "security.enableEncryption" option is set to "true" in the MongoDB configuration file (default location: /etc/mongod.conf) or that MongoDB was started with the "--enableEncryption" command line option.

Check the MongoDB configuration file (default location: /etc/mongod.conf).

If the following parameter is not present, this is a finding.

security:
enableEncryption: "true"

If any mongod process is started with "--enableEncryption false", this is a finding.

Vulnerability Number

V-81883

Documentable

False

Rule Version

MD3X-00-000440

Severity Override Guidance

If the MongoDB Encrypted Storage Engines is being used, ensure that the "security.enableEncryption" option is set to "true" in the MongoDB configuration file (default location: /etc/mongod.conf) or that MongoDB was started with the "--enableEncryption" command line option.

Check the MongoDB configuration file (default location: /etc/mongod.conf).

If the following parameter is not present, this is a finding.

security:
enableEncryption: "true"

If any mongod process is started with "--enableEncryption false", this is a finding.

Check Content Reference

M

Target Key

3265

Comments