V-265947
MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide
Title
MongoDB must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
Description
<VulnDiscussion>DBMSs handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic mechanisms may be native to MongoDB or implemented via additional software or operating system/file system settings, as appropriate to the situation. Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mec...
Fix Text (Documentation Requirement)
Configure encryption at rest through hardware encryption, volume encryption, filesystem encryption, or third-party products if not using MongoDBs native encryption at rest. When using MongoDBs native encryption at rest, configure MongoDB to use the Encrypted Storage Engine and a KMIP appliance as documented here: https://www.mongodb.com/docs/v7.0/core/security-encryption-at-rest/ https://www.mongodb.com/docs/v7.0/tutorial/configure-encryption/