Detections
Analytics

DISA STIG MongoDB Enterprise Advanced 4.x v1r3 DB

Audit Details

Name: DISA STIG MongoDB Enterprise Advanced 4.x v1r3 DB

Updated: 6/17/2024

Authority: DISA STIG

Plugin: MongoDB

Revision: 1.1

Estimated Item Count: 14

File Details

Filename: DISA_STIG_MongoDB_Enterprise_Advanced_4.x_DB_v1r3.audit

Size: 37.9 kB

MD5: 95a7eb6c96753230d828f11684582237
SHA256: 3647958d9fcbfc9f080d1e18eb8f8a44711d1ce5cb19d8bc67c41434c7e59b54

Audit Items

DescriptionCategories
DISA_STIG_MongoDB_Enterprise_Advanced_4.x_DB_v1r3.audit from DISA MongoDB Enterprise Advanced 4.x v1r3 STIG
MD4X-00-000700 - MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

SYSTEM AND COMMUNICATIONS PROTECTION

MD4X-00-001100 - MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage and transmission.

ACCESS CONTROL

MD4X-00-001200 - MongoDB must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

ACCESS CONTROL

MD4X-00-001700 - MongoDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

ACCESS CONTROL

MD4X-00-002000 - MongoDB must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to MongoDB.

CONFIGURATION MANAGEMENT

MD4X-00-002300 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be owned by database/DBMS principals authorized for ownership.

CONFIGURATION MANAGEMENT

MD4X-00-002400 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.

CONFIGURATION MANAGEMENT

MD4X-00-003200 - MongoDB must map the PKI-authenticated identity to an associated user account.

IDENTIFICATION AND AUTHENTICATION

MD4X-00-003400 - MongoDB must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

IDENTIFICATION AND AUTHENTICATION

MD4X-00-005300 - MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

CONFIGURATION MANAGEMENT

MD4X-00-005400 - MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

CONFIGURATION MANAGEMENT

MD4X-00-006200 - When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.

SYSTEM AND INFORMATION INTEGRITY

MD4X-00-006500 - MongoDB products must be a version supported by the vendor.

SYSTEM AND SERVICES ACQUISITION