MD8X-00-000300 - MongoDB must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53|AC-3

CAT|I

CCI|CCI-000213

Rule-ID|SV-279333r1179443_rule

STIG-ID|MD8X-00-000300

Vuln-ID|V-279333

MD8X-00-002700 - MongoDB database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be owned by database/DBMS principals authorized for ownership.

800-53|CM-5(6)

CAT|II

CCI|CCI-001499

Rule-ID|SV-279341r1179506_rule

STIG-ID|MD8X-00-002700

Vuln-ID|V-279341

MD8X-00-002800 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to MongoDB, etc.) must be restricted to authorized users.

Rule-ID|SV-279342r1179447_rule

STIG-ID|MD8X-00-002800

Vuln-ID|V-279342

MD8X-00-003350 - MongoDB must be configured to restrict the use of administrator access to authorized IP addresses.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-282943r1179530_rule

STIG-ID|MD8X-00-003350

Vuln-ID|V-282943

MD8X-00-003400 - MongoDB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-279347r1179208_rule

STIG-ID|MD8X-00-003400

Vuln-ID|V-279347

MD8X-00-003600 - MongoDB must, for password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

800-53|IA-5(1)(d)

CCI|CCI-004062

Rule-ID|SV-279349r1179508_rule

STIG-ID|MD8X-00-003600

Vuln-ID|V-279349

MD8X-00-004000 - MongoDB must map the PKI-authenticated identity to an associated user account.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-279352r1179459_rule

STIG-ID|MD8X-00-004000

Vuln-ID|V-279352

MD8X-00-004400 - MongoDB must separate user functionality (including user interface services) from database management functionality.

800-53|IA-8

800-53|SC-2

CCI|CCI-000804

CCI|CCI-001082

Rule-ID|SV-279355r1179463_rule

STIG-ID|MD8X-00-004400

Vuln-ID|V-279355

MD8X-00-005200 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-279363r1179256_rule

STIG-ID|MD8X-00-005200

Vuln-ID|V-279363

MD8X-00-005500 - MongoDB must check the validity of all data inputs except those specifically identified by the organization.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-279365r1179467_rule

STIG-ID|MD8X-00-005500

Vuln-ID|V-279365

MD8X-00-005800 - MongoDB must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-279367r1179513_rule

STIG-ID|MD8X-00-005800

Vuln-ID|V-279367

MD8X-00-005900 - MongoDB must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA) and database administrator (DBA).

800-53|SI-11b.

CCI|CCI-001314

Rule-ID|SV-279368r1179271_rule

STIG-ID|MD8X-00-005900

Vuln-ID|V-279368

MD8X-00-006200 - MongoDB must associate organization-defined types of security labels having organization-defined security label values with information in storage.

800-53|AC-16a.

CCI|CCI-002262

CCI|CCI-002263

CCI|CCI-002264

Rule-ID|SV-279371r1179515_rule

STIG-ID|MD8X-00-006200

Vuln-ID|V-279371

MD8X-00-006600 - MongoDB must prevent nonprivileged users from executing privileged functions, to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-279373r1179516_rule

STIG-ID|MD8X-00-006600

Vuln-ID|V-279373

MD8X-00-006800 - MongoDB must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

800-53|AU-4

CCI|CCI-001849

Rule-ID|SV-279375r1179292_rule

STIG-ID|MD8X-00-006800

Vuln-ID|V-279375

MD8X-00-007300 - MongoDB must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

800-53|CM-11(2)

CCI|CCI-003980

Rule-ID|SV-279380r1179481_rule

STIG-ID|MD8X-00-007300

Vuln-ID|V-279380

MD8X-00-007400 - MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-279381r1179310_rule

STIG-ID|MD8X-00-007400

Vuln-ID|V-279381

MD8X-00-007600 - MongoDB must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

800-53|CM-7(1)(b)

CCI|CCI-001762

Rule-ID|SV-279382r1179313_rule

STIG-ID|MD8X-00-007600

Vuln-ID|V-279382

MD8X-00-007900 - MongoDB must use NSA-approved cryptography to protect classified information in accordance with the data owner's requirements.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-279385r1179518_rule

STIG-ID|MD8X-00-007900

Vuln-ID|V-279385

MD8X-00-008600 - When invalid inputs are received, MongoDB must behave in a predictable and documented manner that reflects organizational and system objectives.

800-53|SI-10(3)

CCI|CCI-002754

Rule-ID|SV-279390r1179486_rule

STIG-ID|MD8X-00-008600

Vuln-ID|V-279390

Detections

Analytics

DISA MongoDB Enterprise Advanced 8.x STIG v1r1 MongoDB

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous