MD7X-00-006400 MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.

Information

Without the association of security labels to information, there is no basis for MongoDB to make security-related access-control decisions.

Security labels are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.

These labels are typically associated with internal data structures (e.g., tables, rows) within the database and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling, or distribution instructions, or support other aspects of the information security policy.

One example includes marking data as classified or CUI. These security labels may be assigned manually or during data processing, but, either way, it is imperative these assignments are maintained while the data is in storage. If the security labels are lost when the data is stored, there is the risk of a data compromise.

The mechanism used to support security labeling may be a feature of MongoDB product, a third-party product, or custom application code.

Satisfies: SRG-APP-000311-DB-000308, SRG-APP-000313-DB-000309, SRG-APP-000314-DB-000310

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To implement security labeling, ensure the following:

1. Organizational or site specific documentation and guidance is available or developed.

2. Ensure security labels are applied to MongoDB collection(s) requiring them in accordance with the organization or site specific documentation.

3. Create a Security Label Tag Viewer role ("SLTagViewer") with "find" privileges on the specific database and collection that requires security labeling.

In the example below, there are three databases and collections in those databases where security labels are required:

> use admin
> db.createRole(
{
role: "SLTagViewer",
privileges: [
{ resource: { db: "db1", collection: "coll1" }, actions: [ "find" ] },
{ resource: { db: "db1", collection: "coll2" }, actions: [ "find" ] },
{ resource: { db: "db1", collection: "coll3" }, actions: [ "find" ] },
{ resource: { db: "db2", collection: "coll1" }, actions: [ "find" ] },
{ resource: { db: "db2", collection: "coll5" }, actions: [ "find" ] },
{ resource: { db: "db2", collection: "coll9" }, actions: [ "find" ] },
{ resource: { db: "db3", collection: "coll81" }, actions: [ "find" ] }
],
roles: [ ]
},
{ w: "majority" , wtimeout: 5000 }
)

4. Ensure that any query that targets the databases/collections that have security labeling have the appropriate MongoDB $redact operation applied.

The $redact operator is applied through trusted middleware. This trusted middleware configuration is purpose built (custom) code and integrations and is organizational or site specific.
Information on the basics of how this is constructed can be found here: https://www.mongodb.com/docs/v7.0/reference/operator/aggregation/redact/

Item Details

Audit Name: DISA MongoDB Enterprise Advanced 7.x STIG v1r1

Category: ACCESS CONTROL

Plugin: MongoDB

Control ID: 7c8d5701cb20ddc7730ec7c0d59efc7864c654d2d87cd3095fd11f07f15c3f2c

Detections

Analytics

MD7X-00-006400 MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.

Information

Solution

See Also

Item Details