MD3X-00-000010 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-3(7)

CAT|II

CCI|CCI-000015

Rule-ID|SV-96557r1_rule

STIG-ID|MD3X-00-000010

Vuln-ID|V-81843

MD3X-00-000040 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.

800-53|AU-12

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001462

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

CCI|CCI-001851

CCI|CCI-001858

Rule-ID|SV-96561r1_rule

STIG-ID|MD3X-00-000040

Vuln-ID|V-81847

MD3X-00-000190 - The audit information produced by MongoDB must be protected from unauthorized read access.

800-53|CM-6

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

CSCv6|3.1

Rule-ID|SV-96563r1_rule

STIG-ID|MD3X-00-000190

Vuln-ID|V-81849

MD3X-00-000220 - MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-96565r1_rule

STIG-ID|MD3X-00-000220

Vuln-ID|V-81851

MD3X-00-000250 - MongoDB software installation account must be restricted to authorized users.

CCI|CCI-001499

Rule-ID|SV-96567r1_rule

STIG-ID|MD3X-00-000250

Vuln-ID|V-81853

MD3X-00-000260 - Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-96569r1_rule

STIG-ID|MD3X-00-000260

Vuln-ID|V-81855

MD3X-00-000280 - Unused database components, DBMS software, and database objects must be removed.

800-53|SI-7(1)

CCI|CCI-000381

Rule-ID|SV-96573r1_rule

STIG-ID|MD3X-00-000280

Vuln-ID|V-81859

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled - enabled

800-53|CM-7

CCI|CCI-000382

Rule-ID|SV-96575r1_rule

STIG-ID|MD3X-00-000290

Vuln-ID|V-81861

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled - JSONPEnabled

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled - RESTInterfaceEnabled

MD3X-00-000310 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-96577r1_rule

STIG-ID|MD3X-00-000310

Vuln-ID|V-81863

MD3X-00-000320 - If DBMS authentication, using passwords, is employed, MongoDB must enforce the DoD standards for password complexity and lifetime.

CCI|CCI-000192

Rule-ID|SV-96579r1_rule

STIG-ID|MD3X-00-000320

Vuln-ID|V-81865

MD3X-00-000330 - If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-96581r1_rule

STIG-ID|MD3X-00-000330

Vuln-ID|V-81867

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - allowInvalidCertificates

800-53|SC-17

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-96583r1_rule

STIG-ID|MD3X-00-000340

Vuln-ID|V-81869

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - CAFile

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - mode

800-53|SC-8(1)

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords - PEMKeyFile

MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB - CAFile

CAT|I

CCI|CCI-000186

Rule-ID|SV-96585r2_rule

STIG-ID|MD3X-00-000360

Vuln-ID|V-81871

MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB - PEMKeyFile

MD3X-00-000380 - MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.

800-53|SC-13

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-96589r1_rule

STIG-ID|MD3X-00-000380

Vuln-ID|V-81875

MD3X-00-000410 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

CCI|CCI-001188

Rule-ID|SV-96593r1_rule

STIG-ID|MD3X-00-000410

Vuln-ID|V-81879

MD3X-00-000420 - MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

800-53|SC-28(1)

CCI|CCI-001190

CCI|CCI-001665

Rule-ID|SV-96595r1_rule

STIG-ID|MD3X-00-000420

Vuln-ID|V-81881

MD3X-00-000440 - MongoDB must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-96597r1_rule

STIG-ID|MD3X-00-000440

Vuln-ID|V-81883

MD3X-00-000460 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

CCI|CCI-001090

Rule-ID|SV-96599r1_rule

STIG-ID|MD3X-00-000460

Vuln-ID|V-81885

MD3X-00-000470 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources - .conf file

Rule-ID|SV-96601r1_rule

STIG-ID|MD3X-00-000470

Vuln-ID|V-81887

MD3X-00-000470 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources - Data Dir

MD3X-00-000490 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

CCI|CCI-001310

Rule-ID|SV-96603r1_rule

STIG-ID|MD3X-00-000490

Vuln-ID|V-81889

MD3X-00-000500 - MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

Rule-ID|SV-96605r1_rule

STIG-ID|MD3X-00-000500

Vuln-ID|V-81891

MD3X-00-000520 - MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

CCI|CCI-001312

Rule-ID|SV-96607r1_rule

STIG-ID|MD3X-00-000520

Vuln-ID|V-81893

MD3X-00-000530 - MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

CCI|CCI-001314

Rule-ID|SV-96609r1_rule

STIG-ID|MD3X-00-000530

Vuln-ID|V-81895

MD3X-00-000590 - MongoDB must provide the means for individuals in authorized roles to change the auditing to be performed on all application components, based on all selectable event criteria within organization-defined time thresholds.

CCI|CCI-001914

Rule-ID|SV-96615r1_rule

STIG-ID|MD3X-00-000590

Vuln-ID|V-81901

MD3X-00-000600 - MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.

Rule-ID|SV-96617r1_rule

STIG-ID|MD3X-00-000600

Vuln-ID|V-81903

MD3X-00-000620 - MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-96619r1_rule

STIG-ID|MD3X-00-000620

Vuln-ID|V-81905

MD3X-00-000630 - MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-96621r1_rule

STIG-ID|MD3X-00-000630

Vuln-ID|V-81907

MD3X-00-000700 - MongoDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

CCI|CCI-002038

Rule-ID|SV-96627r1_rule

STIG-ID|MD3X-00-000700

Vuln-ID|V-81913

MD3X-00-000710 - MongoDB must prohibit the use of cached authenticators after an organization-defined time period.

CCI|CCI-002007

Rule-ID|SV-96629r1_rule

STIG-ID|MD3X-00-000710

Vuln-ID|V-81915

MD3X-00-000730 - MongoDB must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

CCI|CCI-002470

Rule-ID|SV-96631r1_rule

STIG-ID|MD3X-00-000730

Vuln-ID|V-81917

MD3X-00-000740 - MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

CCI|CCI-002475

Rule-ID|SV-96633r1_rule

STIG-ID|MD3X-00-000740

Vuln-ID|V-81919

MD3X-00-000760 - MongoDB must maintain the confidentiality and integrity of information during preparation for transmission - mode

CCI|CCI-002420

Rule-ID|SV-96635r1_rule

STIG-ID|MD3X-00-000760

Vuln-ID|V-81921

MD3X-00-000770 - MongoDB must maintain the confidentiality and integrity of information during reception - PEMKeyFile

CCI|CCI-002422

Rule-ID|SV-96637r1_rule

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 3.x v1r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.4 May 27, 2022 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.3 Apr 25, 2022 Miscellaneous Metadata updated. References updated.
Revision 1.2 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.1 Jun 17, 2021 Miscellaneous Metadata updated.