DISA_STIG_MongoDB_Enterprise_Advanced_3.x_OS_Linux_v2r2.audit from DISA MongoDB Enterprise Advanced 3.x v2r2 STIG

MD3X-00-000010 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-2(1)

CAT|I

CCI|CCI-000015

Rule-ID|SV-221158r879522_rule

STIG-ID|MD3X-00-000010

STIG-Legacy|SV-96557

STIG-Legacy|V-81843

Vuln-ID|V-221158

MD3X-00-000040 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.

800-53|AU-3

800-53|AU-3(1)

800-53|AU-3(2)

800-53|AU-4(1)

800-53|AU-5(2)

800-53|AU-5b.

800-53|AU-10

800-53|AU-12b.

800-53|AU-12c.

800-53|AU-14(1)

800-53|AU-14(2)

800-53|CM-5(1)

CAT|II

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001462

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

CCI|CCI-001851

CCI|CCI-001858

Rule-ID|SV-221160r879559_rule

STIG-ID|MD3X-00-000040

STIG-Legacy|SV-96561

STIG-Legacy|V-81847

Vuln-ID|V-221160

MD3X-00-000190 - The audit information produced by MongoDB must be protected from unauthorized read access.

800-53|AU-9

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-221161r879576_rule

STIG-ID|MD3X-00-000190

STIG-Legacy|SV-96563

STIG-Legacy|V-81849

Vuln-ID|V-221161

MD3X-00-000220 - MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-221162r879579_rule

STIG-ID|MD3X-00-000220

STIG-Legacy|SV-96565

STIG-Legacy|V-81851

Vuln-ID|V-221162

MD3X-00-000250 - MongoDB software installation account must be restricted to authorized users.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-221163r879586_rule

STIG-ID|MD3X-00-000250

STIG-Legacy|SV-96567

STIG-Legacy|V-81853

Vuln-ID|V-221163

MD3X-00-000260 - Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-221164r879586_rule

STIG-ID|MD3X-00-000260

STIG-Legacy|SV-96569

STIG-Legacy|V-81855

Vuln-ID|V-221164

MD3X-00-000280 - Unused database components, DBMS software, and database objects must be removed.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-221166r879587_rule

STIG-ID|MD3X-00-000280

STIG-Legacy|SV-96573

STIG-Legacy|V-81859

Vuln-ID|V-221166

MD3X-00-000290 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-221167r879587_rule

STIG-ID|MD3X-00-000290

STIG-Legacy|SV-96575

STIG-Legacy|V-81861

Vuln-ID|V-221167

MD3X-00-000310 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-221168r879589_rule

STIG-ID|MD3X-00-000310

STIG-Legacy|SV-96577

STIG-Legacy|V-81863

Vuln-ID|V-221168

MD3X-00-000320 - If DBMS authentication using passwords is employed, MongoDB must enforce the DoD standards for password complexity and lifetime.

800-53|IA-5(1)(a)

CCI|CCI-000192

Rule-ID|SV-221169r879601_rule

STIG-ID|MD3X-00-000320

STIG-Legacy|SV-96579

STIG-Legacy|V-81865

Vuln-ID|V-221169

MD3X-00-000330 - If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

800-53|IA-5(1)(c)

CCI|CCI-000196

Rule-ID|SV-221170r879608_rule

STIG-ID|MD3X-00-000330

STIG-Legacy|SV-96581

STIG-Legacy|V-81867

Vuln-ID|V-221170

MD3X-00-000340 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.

800-53|IA-5(2)(a)

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-221171r879609_rule

STIG-ID|MD3X-00-000340

STIG-Legacy|SV-96583

STIG-Legacy|V-81869

Vuln-ID|V-221171

MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-221172r879613_rule

STIG-ID|MD3X-00-000360

STIG-Legacy|SV-96585

STIG-Legacy|V-81871

Vuln-ID|V-221172

MD3X-00-000380 - MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.

800-53|IA-7

800-53|SC-13

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-221174r879616_rule

STIG-ID|MD3X-00-000380

STIG-Legacy|SV-96589

STIG-Legacy|V-81875

Vuln-ID|V-221174

MD3X-00-000410 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

800-53|SC-23(3)

CCI|CCI-001188

Rule-ID|SV-221176r879639_rule

STIG-ID|MD3X-00-000410

STIG-Legacy|SV-96593

STIG-Legacy|V-81879

Vuln-ID|V-221176

MD3X-00-000420 - MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

800-53|SC-24

CCI|CCI-001190

CCI|CCI-001665

Rule-ID|SV-221177r879640_rule

STIG-ID|MD3X-00-000420

STIG-Legacy|SV-96595

STIG-Legacy|V-81881

Vuln-ID|V-221177

MD3X-00-000440 - MongoDB must protect the confidentiality and integrity of all information at rest.

800-53|SC-28

CCI|CCI-001199

Rule-ID|SV-221178r879642_rule

STIG-ID|MD3X-00-000440

STIG-Legacy|SV-96597

STIG-Legacy|V-81883

Vuln-ID|V-221178

MD3X-00-000460 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-221179r879649_rule

STIG-ID|MD3X-00-000460

STIG-Legacy|SV-96599

STIG-Legacy|V-81885

Vuln-ID|V-221179

MD3X-00-000470 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources.

Rule-ID|SV-221180r879649_rule

STIG-ID|MD3X-00-000470

STIG-Legacy|SV-96601

STIG-Legacy|V-81887

Vuln-ID|V-221180

MD3X-00-000490 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-221181r879652_rule

STIG-ID|MD3X-00-000490

STIG-Legacy|SV-96603

STIG-Legacy|V-81889

Vuln-ID|V-221181

MD3X-00-000500 - MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

Rule-ID|SV-221182r879652_rule

STIG-ID|MD3X-00-000500

STIG-Legacy|SV-96605

STIG-Legacy|V-81891

Vuln-ID|V-221182

MD3X-00-000520 - MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

800-53|SI-11a.

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 3.x v2r2 OS

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous