DISA_STIG_MongoDB_Enterprise_Advanced_3.x_OS_Linux_v2r2.audit from DISA MongoDB Enterprise Advanced 3.x v2r2 STIG

MD3X-00-000010 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-221158r879522_rule

STIG-ID|MD3X-00-000010

STIG-Legacy|SV-96557

STIG-Legacy|V-81843

Vuln-ID|V-221158

MD3X-00-000040 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.

CAT|II

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001462

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

CCI|CCI-001851

CCI|CCI-001858

Rule-ID|SV-221160r879559_rule

STIG-ID|MD3X-00-000040

STIG-Legacy|SV-96561

STIG-Legacy|V-81847

Vuln-ID|V-221160

MD3X-00-000190 - The audit information produced by MongoDB must be protected from unauthorized read access.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-221161r879576_rule

STIG-ID|MD3X-00-000190

STIG-Legacy|SV-96563

STIG-Legacy|V-81849

Vuln-ID|V-221161

MD3X-00-000220 - MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-221162r879579_rule

STIG-ID|MD3X-00-000220

STIG-Legacy|SV-96565

STIG-Legacy|V-81851

Vuln-ID|V-221162

MD3X-00-000250 - MongoDB software installation account must be restricted to authorized users.

CCI|CCI-001499

Rule-ID|SV-221163r879586_rule

STIG-ID|MD3X-00-000250

STIG-Legacy|SV-96567

STIG-Legacy|V-81853

Vuln-ID|V-221163

MD3X-00-000260 - Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-221164r879586_rule

STIG-ID|MD3X-00-000260

STIG-Legacy|SV-96569

STIG-Legacy|V-81855

Vuln-ID|V-221164

MD3X-00-000280 - Unused database components, DBMS software, and database objects must be removed.

CCI|CCI-000381

Rule-ID|SV-221166r879587_rule

STIG-ID|MD3X-00-000280

STIG-Legacy|SV-96573

STIG-Legacy|V-81859

Vuln-ID|V-221166

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

CCI|CCI-000382

Rule-ID|SV-221167r879587_rule

STIG-ID|MD3X-00-000290

STIG-Legacy|SV-96575

STIG-Legacy|V-81861

Vuln-ID|V-221167

MD3X-00-000310 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-221168r879589_rule

STIG-ID|MD3X-00-000310

STIG-Legacy|SV-96577

STIG-Legacy|V-81863

Vuln-ID|V-221168

MD3X-00-000320 - If DBMS authentication using passwords is employed, MongoDB must enforce the DoD standards for password complexity and lifetime.

CCI|CCI-000192

Rule-ID|SV-221169r879601_rule

STIG-ID|MD3X-00-000320

STIG-Legacy|SV-96579

STIG-Legacy|V-81865

Vuln-ID|V-221169

MD3X-00-000330 - If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-221170r879608_rule

STIG-ID|MD3X-00-000330

STIG-Legacy|SV-96581

STIG-Legacy|V-81867

Vuln-ID|V-221170

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-221171r879609_rule

STIG-ID|MD3X-00-000340

STIG-Legacy|SV-96583

STIG-Legacy|V-81869

Vuln-ID|V-221171

MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.

CCI|CCI-000186

Rule-ID|SV-221172r879613_rule

STIG-ID|MD3X-00-000360

STIG-Legacy|SV-96585

STIG-Legacy|V-81871

Vuln-ID|V-221172

MD3X-00-000380 - MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-221174r879616_rule

STIG-ID|MD3X-00-000380

STIG-Legacy|SV-96589

STIG-Legacy|V-81875

Vuln-ID|V-221174

MD3X-00-000410 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

CCI|CCI-001188

Rule-ID|SV-221176r879639_rule

STIG-ID|MD3X-00-000410

STIG-Legacy|SV-96593

STIG-Legacy|V-81879

Vuln-ID|V-221176

MD3X-00-000420 - MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

CCI|CCI-001190

CCI|CCI-001665

Rule-ID|SV-221177r879640_rule

STIG-ID|MD3X-00-000420

STIG-Legacy|SV-96595

STIG-Legacy|V-81881

Vuln-ID|V-221177

MD3X-00-000440 - MongoDB must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-221178r879642_rule

STIG-ID|MD3X-00-000440

STIG-Legacy|SV-96597

STIG-Legacy|V-81883

Vuln-ID|V-221178

MD3X-00-000460 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

CCI|CCI-001090

Rule-ID|SV-221179r879649_rule

STIG-ID|MD3X-00-000460

STIG-Legacy|SV-96599

STIG-Legacy|V-81885

Vuln-ID|V-221179

MD3X-00-000470 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources.

Rule-ID|SV-221180r879649_rule

STIG-ID|MD3X-00-000470

STIG-Legacy|SV-96601

STIG-Legacy|V-81887

Vuln-ID|V-221180

MD3X-00-000490 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

CCI|CCI-001310

Rule-ID|SV-221181r879652_rule

STIG-ID|MD3X-00-000490

STIG-Legacy|SV-96603

STIG-Legacy|V-81889

Vuln-ID|V-221181

MD3X-00-000500 - MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

Rule-ID|SV-221182r879652_rule

STIG-ID|MD3X-00-000500

STIG-Legacy|SV-96605

STIG-Legacy|V-81891

Vuln-ID|V-221182

MD3X-00-000520 - MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

CCI|CCI-001312

Rule-ID|SV-221183r879655_rule

STIG-ID|MD3X-00-000520

STIG-Legacy|SV-96607

STIG-Legacy|V-81893

Vuln-ID|V-221183

MD3X-00-000530 - MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

CCI|CCI-001314

Rule-ID|SV-221184r879656_rule

STIG-ID|MD3X-00-000530

STIG-Legacy|SV-96609

STIG-Legacy|V-81895

Vuln-ID|V-221184

MD3X-00-000600 - MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.

Rule-ID|SV-221188r879729_rule

STIG-ID|MD3X-00-000600

STIG-Legacy|SV-96617

STIG-Legacy|V-81903

Vuln-ID|V-221188

MD3X-00-000620 - MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-221189r879730_rule

STIG-ID|MD3X-00-000620

STIG-Legacy|SV-96619

STIG-Legacy|V-81905

Vuln-ID|V-221189

MD3X-00-000630 - MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-221190r879732_rule

STIG-ID|MD3X-00-000630

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 3.x v2r2 OS

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Aug 26, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Jun 17, 2024 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 3.x v2r2 OS Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG MongoDB Enterprise Advanced 3.x v2r2 OS