MongoDB Encryption Guide: Secure Your Data

Protect your MongoDB data by encrypting it. We show you how to do this with examples.

Securing Data in Transit

To protect the communication between your MongoDB instance and the clients or applications that need to access it from potential hacker attacks, you can encrypt them. Configure them to require connections that use Transport Layer Security (TLS). Like its predecessor, Secure Sockets Layer (SSL), TLS is a cryptographic protocol that encrypts data as it is transmitted over a network.

Note that TLS only encrypts data as it is transmitted over a network – also known as data in transit. Even if you have configured MongoDB to require connections to be made using TLS, the static database data on the server, also known as data at rest, remains unencrypted. It is not possible to encrypt data at rest with the free Community Edition of MongoDB, but this is possible with the paid subscription-based Enterprise Edition of Mongo.

Encryption at Rest and In Transit

Even if both encryption at rest and encryption in transit are enabled, an unauthorised user could potentially still access your sensitive data. For example, imagine that you have deployed a sharded NoSQL document database to store data for an ice cream delivery application you have developed. The database management system allows you to encrypt data at rest, which you enable, and you also configure it to require encrypted TLS connections between shards as well as clients.

Example of a Security Vulnerability

In this example, when a customer places an order, they are asked to enter some sensitive information such as their home address or credit card number. The application then writes this information into the database into a document, such as:
<

  "name" : "Andreas Müller",
  "address" : {
    "street" : "Heganger 29",
    "city" : "Hallstadt",
    "state" : "Bayern",
    "zip" : 96103
  },
  "phone" : "0123 456789-0",
  "creditcard" : "1231231231231231"
   }

Client-Side Field Encryption

To minimise this risk, since version 4.2 the official MongoDB drivers allow client-side field encryption to be performed. This means that an application, if properly configured, can encrypt certain fields within a document before the data is sent to the database. Once the data is written to the database, only applications or clients that can present the correct encryption keys can decrypt and read the data in those fields. Otherwise, the data document would look similar to this example (assuming the street, city, postcode, phone and credit card fields were encrypted on the client side):

  "name" : "Andreas Müller",
  "address" : {
    "street" : BinData(6,"eirefi3eid5feiZae9t+oot0noh9oovoch3=iethoh9t"),
    "city" : BinData(6,"xiesoh+aiveez=ngee1yei+u0aijah2eeKu7jeeB=oGh"),
    "state" : "Bayern",
    "zip" : BinData(6,"CoYeve+ziemaehai=io1Iliehoh6rei2+oo5eic0aeCh")
  },
  "phone" : BinData(6,"quas+eG4chuolau6ahq=i8ahqui0otaek7phe+Miexoo"),
  "creditcard" : BinData(6,"rau0Teez=iju4As9Eeyiu+h4coht=ukae8ahFah4aRo=")
  }

MongoDB Security Best Practices

Security considerations should be a top priority, especially when dealing with the MongoDB database management system. We assist you in managing ongoing security concerns within MongoDB.

Importance of Data Security in MongoDB

The security of our data is of paramount importance, and this holds true for MongoDB, a widely used NoSQL database. In this article, we will discuss how to continuously manage the security of your MongoDB installation, as it’s inevitable that new security vulnerabilities will emerge over time.

Regular Update Checks

Securing your MongoDB database begins with selecting the right settings, but that alone is not sufficient. Equally important is conducting regular inspections and diagnostics to determine the status of your system’s security. An initial step is checking for new updates. MongoDB regularly releases new versions, and it’s crucial to ensure that the version you’re using does not have any unpatched vulnerabilities. MongoDB versions are formatted as X.Y.Z, where X is the major version number, Y is the version or development series number, and Z is the revision or patch number. It is recommended to always update to the latest stable revision within your version series, as it typically includes backward-compatible patches to address issues.

Reconsider Server-Side Script Execution

MongoDB provides the ability to execute server-side JavaScript functions, enhancing query flexibility. For instance, you can use the `$where` operator to employ JavaScript expressions for querying documents. While this offers advantages, it also poses risks as it can potentially enable malicious code. For this reason, MongoDB recommends disabling server-side script execution when not actively in use.

Maintain Input Validation

MongoDB validates user inputs by default to ensure that faulty BSON documents cannot be inserted into the database. While this may not be necessary for every use case, it is advisable to keep input validation enabled to protect the integrity of your database.

Conclusion

In conclusion, it is vital to continuously monitor the security of your MongoDB installation. By regularly updating, reconsidering server-side script execution, and maintaining input validation, you can safeguard your database against potential security threats and preserve the integrity of your data. Security Best Practices The Module Design Pattern in JavaScript: Explained with Examples

MongoDB Security Best Practices for Network Access Control

To ensure the security of data stored in MongoDB, it’s important to restrict network access to the server running the database. This post is intended to assist you in this regard.

Starting with Network Access Restriction

Securing the data stored in MongoDB begins with limiting network access to the server hosting the database. One way to achieve this is by setting up a Virtual Private Network (VPN). A VPN presents a connection as if it were a local private network, facilitating secure communication between servers within it. By using a VPN for MongoDB, you can block access from machines not connected to the same VPN.

Enhancing Security with a Firewall

However, a VPN alone may not be sufficient to prevent unauthorized access to your MongoDB installation. There might be many individuals who require access to your VPN, but only a few of them need access to your MongoDB database. You can further refine control over who can access your data by configuring a firewall on your database server.

A firewall enhances network security by filtering incoming and outgoing traffic based on custom rules. Firewall tools typically allow precise rule-setting, giving you the flexibility to permit connections from specific IP addresses to specific ports on your server. For instance, you can establish rules that only permit an application server to access the port used by your MongoDB installation on your database server.

Limiting Exposure with IP Binding

Another way to limit your database’s network exposure is to configure IP binding. By default, MongoDB is bound to “localhost” after installation. This means that a fresh MongoDB installation will only accept connections from “localhost” or the same server where the MongoDB instance is installed.

This default setting is secure since the database is only accessible to those who already have access to the server it’s installed on. However, it can cause issues when you need to access the database remotely from another computer. In such cases, you can additionally bind your instance to an IP address or hostname from which the remote computer can reach the database server. MongoDB Security Best Practices