V-279387
MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide
Title
MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
Description
<VulnDiscussion>Database management system (DBMSs) handling data requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic mechanisms may be native to the DBMS or implemented via additional software or operating system/file system settings, as appropriate to the situation. Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational informat...
Fix Text (Documentation Requirement)
Configure encryption-at-rest through hardware encryption, volume encryption, filesystem encryption, or third-party products if not using MongoDBs native encryption-at-rest. When using MongoDBs native encryption-at-rest, configure MongoDB to use the Encrypted Storage Engine and a KMIP appliance as documented here: https://www.mongodb.com/docs/v8.0/core/security-encryption-at-rest/ https://www.mongodb.com/docs/v8.0/tutorial/configure-encryption/