DISA_STIG_MongoDB_Enterprise_Advanced_4.x_OS_v1r1.audit from DISA MongoDB Enterprise Advanced 4.x v1r1 STIG

MD4X-00-000100 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.

CAT|II

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

CCI|CCI-001851

CCI|CCI-001858

Rule-ID|SV-252134r817007_rule

STIG-ID|MD4X-00-000100

Vuln-ID|V-252134

MD4X-00-000200 - The audit information produced by MongoDB must be protected from unauthorized access.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-252135r813787_rule

STIG-ID|MD4X-00-000200

Vuln-ID|V-252135

MD4X-00-000300 - MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-252136r813790_rule

STIG-ID|MD4X-00-000300

Vuln-ID|V-252136

MD4X-00-000400 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

CCI|CCI-000381

Rule-ID|SV-252137r813793_rule

STIG-ID|MD4X-00-000400

Vuln-ID|V-252137

MD4X-00-000500 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

CCI|CCI-000382

Rule-ID|SV-252138r816978_rule

STIG-ID|MD4X-00-000500

Vuln-ID|V-252138

MD4X-00-000600 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords. - allowConnectionsWithoutCertificates

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-252139r813799_rule

STIG-ID|MD4X-00-000600

Vuln-ID|V-252139

MD4X-00-000600 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords. - allowInvalidCertificates

MD4X-00-000600 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords. - CAFile

MD4X-00-000600 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords. - certificateKeyFile

MD4X-00-000600 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords. - mode

MD4X-00-000800 - MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

CCI|CCI-001190

CCI|CCI-001665

Rule-ID|SV-252141r813805_rule

STIG-ID|MD4X-00-000800

Vuln-ID|V-252141

MD4X-00-000900 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources. - .conf file

CCI|CCI-001090

Rule-ID|SV-252142r817009_rule

STIG-ID|MD4X-00-000900

Vuln-ID|V-252142

MD4X-00-000900 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources. - Data Dir

MD4X-00-001000 - MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

CCI|CCI-001310

Rule-ID|SV-252143r813811_rule

STIG-ID|MD4X-00-001000

Vuln-ID|V-252143

MD4X-00-001300 - MongoDB must use NIST FIPS 140-2-validated cryptographic modules for cryptographic operations.

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-252146r813820_rule

STIG-ID|MD4X-00-001300

Vuln-ID|V-252146

MD4X-00-001400 - MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-252147r813823_rule

STIG-ID|MD4X-00-001400

Vuln-ID|V-252147

MD4X-00-001550 - MongoDB must limit the total number of concurrent connections to the database.

CCI|CCI-000054

Rule-ID|SV-252148r813826_rule

STIG-ID|MD4X-00-001550

Vuln-ID|V-252148

MD4X-00-001600 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals. - authorization

CCI|CCI-000015

Rule-ID|SV-252149r813829_rule

STIG-ID|MD4X-00-001600

Vuln-ID|V-252149

MD4X-00-001600 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals. - LDAP Server

MD4X-00-002100 - MongoDB software installation account must be restricted to authorized users.

CCI|CCI-001499

Rule-ID|SV-252152r813838_rule

STIG-ID|MD4X-00-002100

Vuln-ID|V-252152

MD4X-00-002200 - Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-252153r813841_rule

STIG-ID|MD4X-00-002200

Vuln-ID|V-252153

MD4X-00-002600 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled. - enabled

Rule-ID|SV-252156r813850_rule

STIG-ID|MD4X-00-002600

Vuln-ID|V-252156

MD4X-00-002600 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled. - JSONPEnabled

MD4X-00-002600 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled. - RESTInterfaceEnabled

MD4X-00-002800 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-252157r813853_rule

STIG-ID|MD4X-00-002800

Vuln-ID|V-252157

MD4X-00-002950 - If passwords are used for authentication, MongoDB must implement LDAP or Kerberos for authentication to enforce the DoD standards for password complexity and lifetime.

CCI|CCI-000192

Rule-ID|SV-252158r813856_rule

STIG-ID|MD4X-00-002950

Vuln-ID|V-252158

MD4X-00-003000 - If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-252159r817005_rule

STIG-ID|MD4X-00-003000

Vuln-ID|V-252159

MD4X-00-003100 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB. - CAFile

CCI|CCI-000186

Rule-ID|SV-252160r813862_rule

STIG-ID|MD4X-00-003100

Vuln-ID|V-252160

MD4X-00-003100 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB. - PEMKeyFile

MD4X-00-003300 - MongoDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

CCI|CCI-000206

Rule-ID|SV-252162r813868_rule

STIG-ID|MD4X-00-003300

Vuln-ID|V-252162

MD4X-00-003700 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

CCI|CCI-001188

Rule-ID|SV-252164r817013_rule

STIG-ID|MD4X-00-003700

Vuln-ID|V-252164

MD4X-00-003800 - MongoDB must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-252165r813877_rule

STIG-ID|MD4X-00-003800

Vuln-ID|V-252165

MD4X-00-004000 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

Rule-ID|SV-252166r813880_rule

STIG-ID|MD4X-00-004000

Vuln-ID|V-252166

MD4X-00-004100 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

Rule-ID|SV-252167r813883_rule

STIG-ID|MD4X-00-004100

Vuln-ID|V-252167

MD4X-00-004200 - MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

CCI|CCI-001312

Rule-ID|SV-252168r813886_rule

STIG-ID|MD4X-00-004200

Vuln-ID|V-252168

MD4X-00-004300 - MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

CCI|CCI-001314

Rule-ID|SV-252169r813889_rule

STIG-ID|MD4X-00-004300

Vuln-ID|V-252169

MD4X-00-004400 - MongoDB must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

CCI|CCI-002361

Rule-ID|SV-252170r813892_rule

STIG-ID|MD4X-00-004400

Vuln-ID|V-252170

MD4X-00-004800 - MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.

Rule-ID|SV-252171r813895_rule

STIG-ID|MD4X-00-004800

Vuln-ID|V-252171

MD4X-00-004900 - MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-252172r813898_rule

STIG-ID|MD4X-00-004900

Vuln-ID|V-252172

MD4X-00-005000 - MongoDB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75 percent of maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-252173r813901_rule

STIG-ID|MD4X-00-005000

Vuln-ID|V-252173

MD4X-00-005600 - MongoDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

CCI|CCI-002038

Rule-ID|SV-252176r816993_rule

STIG-ID|MD4X-00-005600

Vuln-ID|V-252176

MD4X-00-005700 - MongoDB must prohibit the use of cached authenticators after an organization-defined time period.

CCI|CCI-002007

Rule-ID|SV-252177r813913_rule

STIG-ID|MD4X-00-005700

Vuln-ID|V-252177

MD4X-00-005800 - MongoDB must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

CCI|CCI-002470

Rule-ID|SV-252178r817015_rule

STIG-ID|MD4X-00-005800

Vuln-ID|V-252178

MD4X-00-006000 - MongoDB must maintain the confidentiality and integrity of information during preparation for transmission.

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 4.x v1r1 OS

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.5

Miscellaneous

Added

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.5 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated. Added DISA_STIG_MongoDB_Enterprise_Advanced_4.x_OS_v1r1.audit from DISA MongoDB Enterprise Advanced 4.x v1r1 STIG
Revision 1.4 Mar 7, 2023 Miscellaneous Metadata updated.
Revision 1.3 Feb 28, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated. Variables updated.
Revision 1.2 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.1 Jun 3, 2022 Miscellaneous Metadata updated.