θϩτϥετͱ 2017 2020 2021 2022 O’Reilly NIST SP800-207 NCSC σδλϧி • The Network is always assumed to be hostile.
• External and internal threats exists on the network at all times
• Network locality is not suf fi cient for decagon trust in a network
• Every device, user, and network fl ow is authenticated and authorized
• Policies must be dynamic and calculated from as many sources of data as possible • The entire enterprise private network is not considered an implicit trust zone
• Devices on the network may not be owned of con fi gurable by the enterprise.
• No resource is inherently trusted.
• Not all enterprise resources are on enterprise-owned infrastructure
• Remote enterprise subjects and assets cannot fully trust their local network connection
• Assets and work fl ows moving between enterprise and non enterprise infrastructure should have a consistent security and posture
θϩτϥετͱ 2017 2020 2021 2022 O’Reilly NIST SP800-207 NCSC σδλϧி • The Network is always assumed to be hostile.
• External and internal threats exists on the network at all times
• Network locality is not suf fi cient for decagon trust in a network
• Every device, user, and network fl ow is authenticated and authorized • Policies must be dynamic and calculated from as many sources of data as possible • The entire enterprise private network is not considered an implicit trust zone
• Devices on the network may not be owned of con fi gurable by the enterprise.
• No resource is inherently trusted.
• Not all enterprise resources are on enterprise-owned infrastructure
• Remote enterprise subjects and assets cannot fully trust their local network connection
• Assets and work fl ows moving between enterprise and non enterprise infrastructure should have a consistent security and posture
"description": "MongoDB is a source-available, cross-platform document- oriented database program. Classified as a NoSQL database program, MongoDB uses JSON-like documents with optional schemas.",
"purpose": "Provides a NoSQL database service",
"responsible-roles": [
{
"role-id": "provider",
"party-uuids": [
"ef7c799a-c50e-49ab-83e0-515e989e6df1"
]
}
],
"protocols": [
{
"uuid": "2b4a1b3a-cbc5-4cc8-bde6-7437c28c4e54",
"name": "mongodb",
"title": "Primary daemon process for the MongoDB system.",
"port-ranges": [
{
"start": 27017,
"end": 27017,
"transport": "TCP"
}
]
},
{
"uuid": "99d8d4e5-e734-4e05-a2f9-7353097b8b61",
"name": "mongodb-shardsrv",
"title": "MongoDB protocol for sharding with shardsrv option.",
"port-ranges": [
{
"start": 27018,
"end": 27018,
"transport": "TCP"
}
]
},
{
"uuid": "6fa762f1-09ca-44d5-a94c-cfceb57debd5",
"name": "mongodb-configsvr",
"title": "MongoDB protocol for configsrv operation.",
"description": "MongoDB control implementations for NIST SP 800-53 revision 5.",
"implemented-requirements": [
{
"uuid": "cf8338c5-fb6e-4593-a4a8-b3c4946ee2a0",
"control-id": "sc-8.1",
"description": "MongoDB supports TLS 1.x to encrypt data in transit, preventing unauthorized disclosure or changes to information during transmission. To implement TLS, set the PEMKeyFile option in the configuration /etc/ mongod.conf to the certificate file's path and restart the the component."
},
{
"uuid": "cf8338c5-fb6e-4593-a4a8-b3c4946ee2a0",
"control-id": "sa-4.9",
"description": "Must ensure that MongoDB only listens for network connections on authorized interfaces by configuring the MongoDB configuration file to limit the services exposure to only the network interfaces on which MongoDB 28
ken5scal
yuj1osm
sat
muziyoshiz
akkie76
coconala_engineer
niftycorp
masa5555
loglass2019
sansantech
biwashi
route06
keathley
csswizardry
lynnandtonic
skipperchong
addyosmani
morganepeng
moore
chrisshort
paigeccino
eileencodes
shpigford
holman