DISA_MongoDB_Enterprise_Advanced_7.x_STIG_v1r1_Unix.audit from DISA MongoDB Enterprise Advanced 7.x STIG v1r1

MD7X-00-000150 MongoDB must limit the total number of concurrent connections to the database.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-265973r1028715_rule

STIG-ID|MD7X-00-000150

Vuln-ID|V-265973

MD7X-00-000200 MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-2(1)

CAT|I

CCI|CCI-000015

Rule-ID|SV-265905r1028704_rule

STIG-ID|MD7X-00-000200

Vuln-ID|V-265905

MD7X-00-000400 MongoDB must provide audit record generation for DOD-defined auditable events within all DBMS/database components.

800-53|AU-3

800-53|AU-3(1)

800-53|AU-3(2)

800-53|AU-5b.

800-53|AU-10

800-53|AU-12a.

800-53|AU-12b.

800-53|AU-12c.

800-53|AU-14(1)

800-53|CM-5(1)

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000169

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

Rule-ID|SV-265907r1028717_rule

STIG-ID|MD7X-00-000400

Vuln-ID|V-265907

MD7X-00-002000 The audit information produced by MongoDB must be protected from unauthorized access.

800-53|AU-9

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-265908r1028718_rule

STIG-ID|MD7X-00-002000

Vuln-ID|V-265908

MD7X-00-002300 MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-265909r1028719_rule

STIG-ID|MD7X-00-002300

Vuln-ID|V-265909

MD7X-00-002600 MongoDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to MongoDB.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-265910r1028793_rule

STIG-ID|MD7X-00-002600

Vuln-ID|V-265910

MD7X-00-002700 MongoDB software installation account must be restricted to authorized users.

Rule-ID|SV-265911r1028721_rule

STIG-ID|MD7X-00-002700

Vuln-ID|V-265911

MD7X-00-002800 Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-265912r1028522_rule

STIG-ID|MD7X-00-002800

Vuln-ID|V-265912

MD7X-00-003200 Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

800-53|CM-7a.

800-53|CM-7b.

CCI|CCI-000381

CCI|CCI-000382

Rule-ID|SV-265915r1028531_rule

STIG-ID|MD7X-00-003200

Vuln-ID|V-265915

MD7X-00-003800 If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

800-53|IA-5(1)(c)

CCI|CCI-000196

Rule-ID|SV-265917r1028796_rule

STIG-ID|MD7X-00-003800

Vuln-ID|V-265917

MD7X-00-003900 If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.

800-53|IA-5(2)(a)

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-265918r1028797_rule

STIG-ID|MD7X-00-003900

Vuln-ID|V-265918

MD7X-00-004100 MongoDB must enforce authorized access to all PKI private keys stored/used by MongoDB.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-265919r1028543_rule

STIG-ID|MD7X-00-004100

Vuln-ID|V-265919

MD7X-00-004300 MongoDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

800-53|IA-6

CCI|CCI-000206

Rule-ID|SV-265921r1028798_rule

STIG-ID|MD7X-00-004300

Vuln-ID|V-265921

MD7X-00-004400 MongoDB must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

800-53|IA-7

800-53|SC-13

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-265922r1028799_rule

STIG-ID|MD7X-00-004400

Vuln-ID|V-265922

MD7X-00-004900 MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

800-53|SC-23(3)

CCI|CCI-001188

Rule-ID|SV-265925r1028561_rule

STIG-ID|MD7X-00-004900

Vuln-ID|V-265925

MD7X-00-005200 MongoDB must protect the confidentiality and integrity of all information at rest.

800-53|SC-28

CCI|CCI-001199

Rule-ID|SV-265926r1028802_rule

STIG-ID|MD7X-00-005200

Vuln-ID|V-265926

MD7X-00-005400 Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-265927r1028567_rule

STIG-ID|MD7X-00-005400

Vuln-ID|V-265927

MD7X-00-005500 MongoDB must prevent unauthorized and unintended information transfer via shared system resources.

Rule-ID|SV-265928r1028570_rule

STIG-ID|MD7X-00-005500

Vuln-ID|V-265928

MD7X-00-005800 MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-265930r1028805_rule

STIG-ID|MD7X-00-005800

Vuln-ID|V-265930

MD7X-00-006700 MongoDB must enforce discretionary access control (DAC) policies, as defined by the data owner, over defined subjects and objects.

800-53|AC-3(4)

CCI|CCI-002165

Rule-ID|SV-265935r1031272_rule

STIG-ID|MD7X-00-006700

Vuln-ID|V-265935

MD7X-00-007200 MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

800-53|AU-4

CCI|CCI-001849

Rule-ID|SV-265938r1028600_rule

STIG-ID|MD7X-00-007200

Vuln-ID|V-265938

MD7X-00-007300 MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.

800-53|AU-5(1)

CCI|CCI-001855

Rule-ID|SV-265939r1028603_rule

STIG-ID|MD7X-00-007300

Vuln-ID|V-265939

MD7X-00-007400 MongoDB must provide an immediate real-time alert to appropriate support staff of all audit log failures.

800-53|AU-5(2)

CCI|CCI-001858

Rule-ID|SV-265940r1028815_rule

STIG-ID|MD7X-00-007400

Vuln-ID|V-265940

MD7X-00-007700 MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

800-53|CM-11(2)

CCI|CCI-001812

Rule-ID|SV-265941r1028609_rule

STIG-ID|MD7X-00-007700

Vuln-ID|V-265941

MD7X-00-008400 MongoDB must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

800-53|SC-23(5)

CCI|CCI-002470

Rule-ID|SV-265946r1028723_rule

STIG-ID|MD7X-00-008400

Vuln-ID|V-265946

MD7X-00-008500 MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

800-53|SC-28(1)

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-265947r1028627_rule

STIG-ID|MD7X-00-008500

Vuln-ID|V-265947

MD7X-00-008800 MongoDB must maintain the confidentiality and integrity of information during preparation for transmission.

800-53|SC-8(2)

CCI|CCI-002420

Rule-ID|SV-265948r1028630_rule

STIG-ID|MD7X-00-008800

Vuln-ID|V-265948

MD7X-00-008900 MongoDB must maintain the confidentiality and integrity of information during reception.

CCI|CCI-002422

Rule-ID|SV-265949r1028633_rule

STIG-ID|MD7X-00-008900

Vuln-ID|V-265949

MD7X-00-009100 When updates are applied to MongoDB software, any software components that have been replaced or made unnecessary must be removed.

800-53|SI-2(6)

CCI|CCI-002617

Rule-ID|SV-265951r1028639_rule

STIG-ID|MD7X-00-009100

Detections

Analytics

DISA MongoDB Enterprise Advanced 7.x STIG v1r1

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous