DISA_STIG_MongoDB_Enterprise_Advanced_4.x_OS_v1r3.audit from DISA MongoDB Enterprise Advanced 4.x v1r3 STIG

MD4X-00-000100 - MongoDB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.

800-53|AU-3

800-53|AU-3(1)

800-53|AU-3(2)

800-53|AU-4(1)

800-53|AU-5(2)

800-53|AU-5b.

800-53|AU-10

800-53|AU-12b.

800-53|AU-12c.

800-53|AU-14(1)

800-53|CM-5(1)

CAT|II

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000140

CCI|CCI-000166

CCI|CCI-000171

CCI|CCI-000172

CCI|CCI-001464

CCI|CCI-001487

CCI|CCI-001814

CCI|CCI-001844

CCI|CCI-001851

CCI|CCI-001858

Rule-ID|SV-252134r879559_rule

STIG-ID|MD4X-00-000100

Vuln-ID|V-252134

MD4X-00-000200 - The audit information produced by MongoDB must be protected from unauthorized access.

800-53|AU-9

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-252135r879576_rule

STIG-ID|MD4X-00-000200

Vuln-ID|V-252135

MD4X-00-000300 - MongoDB must protect its audit features from unauthorized access.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-252136r879579_rule

STIG-ID|MD4X-00-000300

Vuln-ID|V-252136

MD4X-00-000400 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-252137r879587_rule

STIG-ID|MD4X-00-000400

Vuln-ID|V-252137

MD4X-00-000500 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-252138r879588_rule

STIG-ID|MD4X-00-000500

Vuln-ID|V-252138

MD4X-00-000600 - If passwords are used for authentication, MongoDB must transmit only encrypted representations of passwords.

800-53|IA-5(1)(c)

800-53|IA-5(2)(a)

CAT|I

CCI|CCI-000185

CCI|CCI-000197

Rule-ID|SV-252139r879609_rule

STIG-ID|MD4X-00-000600

Vuln-ID|V-252139

MD4X-00-000800 - MongoDB must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

800-53|SC-24

CCI|CCI-001190

CCI|CCI-001665

Rule-ID|SV-252141r879640_rule

STIG-ID|MD4X-00-000800

Vuln-ID|V-252141

MD4X-00-000900 - MongoDB must prevent unauthorized and unintended information transfer via shared system resources.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-252142r879649_rule

STIG-ID|MD4X-00-000900

Vuln-ID|V-252142

MD4X-00-001000 - MongoDB and associated applications must reserve the use of dynamic code execution for situations that require it.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-252143r879652_rule

STIG-ID|MD4X-00-001000

Vuln-ID|V-252143

MD4X-00-001300 - MongoDB must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

800-53|IA-7

800-53|SC-13

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-252146r879616_rule

STIG-ID|MD4X-00-001300

Vuln-ID|V-252146

MD4X-00-001400 - MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

800-53|SC-28(1)

CCI|CCI-002475

CCI|CCI-002476

Rule-ID|SV-252147r879799_rule

STIG-ID|MD4X-00-001400

Vuln-ID|V-252147

MD4X-00-001550 - MongoDB must limit the total number of concurrent connections to the database.

800-53|AC-10

CCI|CCI-000054

Rule-ID|SV-252148r879511_rule

STIG-ID|MD4X-00-001550

Vuln-ID|V-252148

MD4X-00-001600 - MongoDB must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-2(1)

CCI|CCI-000015

Rule-ID|SV-252149r879522_rule

STIG-ID|MD4X-00-001600

Vuln-ID|V-252149

MD4X-00-002100 - MongoDB software installation account must be restricted to authorized users.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-252152r879586_rule

STIG-ID|MD4X-00-002100

Vuln-ID|V-252152

MD4X-00-002200 - Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-252153r879586_rule

STIG-ID|MD4X-00-002200

Vuln-ID|V-252153

MD4X-00-002600 - Unused database components that are integrated in MongoDB and cannot be uninstalled must be disabled.

Rule-ID|SV-252156r879587_rule

STIG-ID|MD4X-00-002600

Vuln-ID|V-252156

MD4X-00-002800 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-252157r879589_rule

STIG-ID|MD4X-00-002800

Vuln-ID|V-252157

MD4X-00-002950 - If passwords are used for authentication, MongoDB must implement LDAP or Kerberos for authentication to enforce the DoD standards for password complexity and lifetime.

800-53|IA-5(1)(a)

CCI|CCI-000192

Rule-ID|SV-252158r879601_rule

STIG-ID|MD4X-00-002950

Vuln-ID|V-252158

MD4X-00-003000 - If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

CCI|CCI-000196

Rule-ID|SV-252159r879608_rule

STIG-ID|MD4X-00-003000

Vuln-ID|V-252159

MD4X-00-003100 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-252160r879613_rule

STIG-ID|MD4X-00-003100

Vuln-ID|V-252160

MD4X-00-003300 - MongoDB must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.

800-53|IA-6

CCI|CCI-000206

Rule-ID|SV-252162r879615_rule

STIG-ID|MD4X-00-003300

Vuln-ID|V-252162

MD4X-00-003700 - MongoDB must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

800-53|SC-23(3)

CCI|CCI-001188

Rule-ID|SV-252164r879639_rule

STIG-ID|MD4X-00-003700

Vuln-ID|V-252164

MD4X-00-003800 - MongoDB must protect the confidentiality and integrity of all information at rest.

800-53|SC-28

CCI|CCI-001199

Rule-ID|SV-252165r879642_rule

STIG-ID|MD4X-00-003800

Vuln-ID|V-252165

MD4X-00-004000 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

Rule-ID|SV-252166r879649_rule

STIG-ID|MD4X-00-004000

Vuln-ID|V-252166

MD4X-00-004100 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

Rule-ID|SV-252167r879652_rule

STIG-ID|MD4X-00-004100

Vuln-ID|V-252167

MD4X-00-004200 - MongoDB must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-252168r879655_rule

STIG-ID|MD4X-00-004200

Vuln-ID|V-252168

MD4X-00-004300 - MongoDB must reveal detailed error messages only to the ISSO, ISSM, SA, and DBA.

800-53|SI-11b.

CCI|CCI-001314

Rule-ID|SV-252169r879656_rule

STIG-ID|MD4X-00-004300

Vuln-ID|V-252169

MD4X-00-004400 - MongoDB must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

800-53|AC-12

CCI|CCI-002361

Rule-ID|SV-252170r879673_rule

STIG-ID|MD4X-00-004400

Vuln-ID|V-252170

MD4X-00-004800 - MongoDB must utilize centralized management of the content captured in audit records generated by all components of MongoDB.

Rule-ID|SV-252171r879729_rule

STIG-ID|MD4X-00-004800

Vuln-ID|V-252171

MD4X-00-004900 - MongoDB must allocate audit record storage capacity in accordance with site audit record storage requirements.

Detections

Analytics

DISA STIG MongoDB Enterprise Advanced 4.x v1r3 OS

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous