High profile security breaches have become embarrassingly common, but ultimately avoidable. Now more than ever, database security is a critical component of any production application. In this talk we'll learn to secure your deployment in accordance with best practices and compliance regulations. We'll explore the MongoDB Enterprise features which ensure HIPAA and PCI compliance, and protect you against attack, data exposure and a damaged reputation.

2. Architecting Secure and Compliant Applications
with MongoDB
jason.mimick@mongodb.com
@jmimick
Senior Consulting Engineer – MongoDB Inc

3. 6

4. 7
Concepts
developer friendly production ready

5. 8
Agenda
Concepts
Best Practices
Demo

6. 9
Concepts
Authentication
Authorization
Validating a user
is who
they say they
are
Only letting a user
do certain things

7. 10
WARNING
Some features only supported in
MongoDB Enterprise Advanced versions!
Generally, functionality available in 2.6.x
Will call out any specific 3.0.x features

8. 11
Concepts
Auditing
Encryption
Tracking system
activity
Encoding data
so that only
those with the
key can read it

9. 12
Authentication
password-based challenge-response mechanism
- user/pwd – defined against a DB
- Different auth mechanisms (changed in 3.0)
- SCRAM-SHA-1, MONGO-CR
- Kerberos, LDAP
x.509 certificates
- validate members of replica set’s
and sharded cluster’s are who you think
they are
- also used in SSL connections

10. How do you make
your MongoDB
authorize users?

11. 14
[ec2-user@ip-10-0-214-82 ~]$ mongod --dbpath ./db --auth

12. 15
Localhost Exception
The localhost exception allows you to enable authorization
before creating the first user in the system. When active, the
localhost exception allows connections from the localhost
interface to create the first user on the admin database. The
exception applies only when there are no users created in the
MongoDB instance.
Changed in version 3.0: The localhost exception changed so
that these connections only have access to create the first
user on the admin database. In previous versions,
connections that gained access using the localhost exception
had unrestricted access to the MongoDB instance.

13. 16
Authorization
Role Based Access Control
built-ins, and custom
var stockerRole = {
“role” : “acme.store.stocker”,
“privileges” : [
{ “resource” : {
“db” : “products”,
“collection” : “inventory” },
“actions” : [ “find”, “update” ]
} ],
“roles” : [ “acme.store.user” ]
}
use acme
db.createRole( stockerRole );

14. 17
Auditing
Can audit on your mongod and mongos
Send events to console, syslog, JSON or BSON file
mongod --dbpath data/db --auditDestination file
--auditFormat JSON
--auditPath data/db/auditLog.json
[ec2-user@ip-10-0-214-82 ~]$ tail -f auditLog.json
{ "atype" : "shutdown", "ts" : { "$date" : "2015-05-22T14:30:52.213+0000" }, "local" : { "ip"
: "(NONE)", "port" : 0 }, "remote" : { "ip" : "(NONE)", "port" : 0 }, "users" : [], "roles" :
[], "param" : {}, "result" : 0 }
{ "atype" : "createCollection", "ts" : { "$date" : "2015-05-22T14:30:58.960+0000" }, "local" :
{ "ip" : "(NONE)", "port" : 0 }, "remote" : { "ip" : "(NONE)", "port" : 0 }, "users" : [ {
"user" : "__system", "db" : "local" } ], "roles" : [], "param" : { "ns" : "local.startup_log"
}, "result" : 0 }
{ "atype" : "createCollection", "ts" : { "$date" : "2015-05-22T14:31:24.661+0000"
}, "local" : { "ip" : "127.0.0.1", "port" : 27017 }, "remote" : { "ip" :
"127.0.0.1", "port" : 56023 }, "users" : [], "roles" : [], "param" : { "ns" :
"foo.foo" }, "result" : 0 }

15. 18
Encryption
At rest – recommend to always encrypt data on storage system
3rd party tools – more doc online:
• Linux Unified Key Setup (LUKS) LUKS
• IBM Guardium Data Encryption
• Vormetric Data Security Platform
• Bitlocker Drive Encryption (Windows)
Required for HIPAA/PCI-DSS
Configure mongod and mongos for SSL
mongod --sslMode requireSSL --sslPEMKeyFile /etc/ssl/mongodb.pem

16. 19
Best Practices
http://docs.mongodb.org/manual/administration/security-checklist/
Security Checklist
• Require Authentication
• Configure Roles
• Use SSL
• Configure firewall – limit network exposure
• Turn on auditing
• Encrypt data on disk
• Run mongod with dedicated user account
• Set secure options
• --noscripting
• Disable REST/HTTP

17. 20
Demo
Building roles to support healthcare
application and HIPAA requirements.
In general for full details on HIPAA and PCI-DSS standards compliance see:
http://s3.amazonaws.com/info-mongodb-com/MongoDB_Security_Architecture_WP.pdf

18. 21
Demo
Role Create Read Update Delete Index
(Maintenance)
Physician
Billing Associate
Patient System
Administrator

19. 22
Demo
createRoles.js
createUsers.js
Sample application

20. THANKS!
jason.mimick@mongodb.com