DISA_STIG_MongoDB_Enterprise_Advanced_4.x_DB_v1r4.audit from DISA MongoDB Enterprise Advanced 4.x v1r4 STIG

MD4X-00-000700 - MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

800-53|SC-2

CAT|II

CCI|CCI-001082

Rule-ID|SV-252140r961095_rule

STIG-ID|MD4X-00-000700

Vuln-ID|V-252140

MD4X-00-001100 - MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage and transmission.

800-53|AC-16a.

CCI|CCI-002262

CCI|CCI-002263

CCI|CCI-002264

Rule-ID|SV-252144r961269_rule

STIG-ID|MD4X-00-001100

Vuln-ID|V-252144

MD4X-00-001200 - MongoDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

800-53|AC-3(4)

800-53|AC-6(10)

CCI|CCI-002165

CCI|CCI-002235

Rule-ID|SV-252145r961317_rule

STIG-ID|MD4X-00-001200

Vuln-ID|V-252145

MD4X-00-001700 - MongoDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53|AC-3

CAT|I

CCI|CCI-000213

Rule-ID|SV-252150r960792_rule

STIG-ID|MD4X-00-001700

Vuln-ID|V-252150

MD4X-00-002000 - MongoDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to MongoDB.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-252151r960960_rule

STIG-ID|MD4X-00-002000

Vuln-ID|V-252151

MD4X-00-002300 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be owned by database/DBMS principals authorized for ownership.

Rule-ID|SV-252154r960960_rule

STIG-ID|MD4X-00-002300

Vuln-ID|V-252154

MD4X-00-002400 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.

Rule-ID|SV-252155r960960_rule

STIG-ID|MD4X-00-002400

Vuln-ID|V-252155

MD4X-00-003200 - MongoDB must map the PKI-authenticated identity to an associated user account.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-252161r961044_rule

STIG-ID|MD4X-00-003200

Vuln-ID|V-252161

MD4X-00-003400 - MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

800-53|IA-8

CCI|CCI-000804

Rule-ID|SV-252163r961053_rule

STIG-ID|MD4X-00-003400

Vuln-ID|V-252163

MD4X-00-005300 - MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

800-53|CM-11(2)

CCI|CCI-001812

Rule-ID|SV-252174r981956_rule

STIG-ID|MD4X-00-005300

Vuln-ID|V-252174

MD4X-00-005400 - MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-252175r961461_rule

STIG-ID|MD4X-00-005400

Vuln-ID|V-252175

MD4X-00-006200 - When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.

800-53|SI-10(3)

CCI|CCI-002754

Rule-ID|SV-252181r961656_rule

STIG-ID|MD4X-00-006200

Vuln-ID|V-252181

MD4X-00-006500 - MongoDB products must be a version supported by the vendor.

800-53|SA-22a.

CCI|CCI-003376

Rule-ID|SV-252184r998313_rule

STIG-ID|MD4X-00-006500

Vuln-ID|V-252184

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 4.x v1r4 DB

Audit Details

File Details

Audit Changelog

No revisions found