MongoDB 8.x STIG — Free Checklist (22 Items) | TickYouOff

22 items · Security · Hard difficulty · 4 hours

Practical steps to harden MongoDB Enterprise Advanced 8.x to STIG standards.

• Verify operating system is FIPS-compliant and cryptography-enabled

  Confirm OS/FIPS module is validated and crypto is enabled per CMVP requirements.

• Install MongoDB Enterprise Advanced 8.x from official repositories

  Use vendor packages or signed repos to ensure authenticity.

• Configure and validate FIPS-certified OpenSSL libraries for MongoDB

  Ensure MongoDB links to FIPS 140-2/140-3 certified libraries where required.

• Enable MongoDB authentication (set security.authorization to 'enabled')
• Create administrative users with strong credentials

  Use SCRAM or x.509; store admin credentials securely.

• Configure role-based access control for least privilege

  Assign minimal roles and avoid granting root/admin unnecessarily.

• Bind MongoDB to required network interfaces
• Set bindIp to specific host IPs or interfaces

  Avoid 0.0.0.0; restrict to necessary addresses.

• Disable remote connections if not required

  Combine bind settings with firewall rules to block access.

• Enable TLS/SSL for client and internal node communications
• Install and validate TLS certificates from a trusted CA

  Ensure CN/SAN match hostnames and certificate chain validates.

• Configure requireTLS and secure cipher suites

  Disable weak ciphers and prefer TLS 1.2/1.3.

• Enable MongoDB audit logging and configure retention and forwarding

  Log login, config changes, and admin actions; forward to SIEM.

• Review database user roles and enforce least privilege

  Audit existing accounts and remove unnecessary privileges.

• Enable encryption at rest using the WiredTiger encrypted storage engine

  Configure storageEngine.encryption to protect data files.

• Configure external key management (KMIP or cloud KMS) and rotate keys regularly

  Integrate KMIP or KMS for key storage and enforce rotation policies.

• Disable HTTP status interface and other unused MongoDB features

  Turn off deprecated or unnecessary endpoints to reduce attack surface.

• Configure host firewall and network segmentation for the database server

  Limit access to DB ports and use VLANs or subnets where possible.

• Implement automated backups and regularly test point-in-time restores

  Schedule backups, verify integrity, and perform restore drills.

• Configure monitoring, alerting, and review logs for suspicious activity

  Set alerts for auth failures, configuration changes, and high usage.

• Harden file system permissions for data directories and MongoDB config files

  Restrict ownership and access to dbpath, keyfiles, and mongod.conf.

• Keep MongoDB and the operating system up to date; apply security patches promptly

  Track vendor advisories and schedule maintenance windows for updates.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.