MongoDB Security Introduction - Presentation
Download as PPTX, PDF0 likes718 views
The document discusses the importance of securing MongoDB, highlighting a significant increase in ransom incidents tracked by security researcher Niall Merrigan. It outlines various security measures, including authentication mechanisms, role-based access control, auditing, and encryption techniques to protect databases. The content emphasizes the need for accountability and monitoring to safeguard against unauthorized access and data breaches.
MongoDB Security Introduction - Presentation
- 2. CONTENTS 1. Introduction MongoDB security 2. Why mongoDB security important 3. How to secure your mongodb
- 3. SECURITY
- 4. Niall Merrigan, security researcher and Microsoft developer based in norway, has been tracking the mongodb ransom incidents, and in one day, he saw the number of attacks more than double from 12,000 to 27,633. SECURITY ATTACKS
- 5. Attackers have been accessing databases, copying files, deleting everything and leaving a ransom note promising the return of the data for a fee. WHAT HACKER DO WITH DATABASES
- 7. REFERENCE ARCHITECTURE Clients Storage Administrators Authentication Authorization Auditing Encryption
- 8. AUTHENTICATION Clients Storage Administrators Authentication Authorization Auditing Encryption Which users/apps are accessing the DB Which nodes are joining the cluster Which users are accessing the DB
- 9. AUTHENTICATION MECHANISM Client/User Auth • SCRAM-SHA-1 • MONGODB-CR • X.509 • LDAP • Kerberos Internal Auth • Keyfile (SCRAM-SHA-1) • X.509
- 11. AUTHORIZATION Clients Storage Administrators Authentication Authorization Auditing Encryption What permissions does an App have? What permissions does an Admin have? What data can a user see? What data can an admin see?
- 12. WHY ROLE BASE ACCESS CONTROL
- 13. BUILT IN ROLES
- 15. ACTIONS
- 16. RESOURCES
- 17. AUDITING Clients Storage Administrators Authentication Authorization Auditing Encryption Who made which changes and when? Who made which changes and when?
- 18. AUDITING 1. Add accountability 2. Investigate suspicious activity 3. Monitor database activity
- 19. AUDITING
- 20. ENCRYPTION Clients Storage Administrators Authentication Authorization Auditing Encryption SSL Encryption SSL Encryption File system Encryption
- 21. ENCRYPTION TYPE 1. Transport Encryption 2. Encryption at rest
- 24. Thank You
- 25. CONTACT US • Development Center : Habilelabs Pvt. Ltd. 4th Floor, I.G.M. Senior Secondary Public School Campus, Sec-93 Agarwal Farm, Mansarovar, Jaipur(Raj.) – 302020 • Email : [email protected] • Web : https://habilelabs.io • Telephone: +91-9828247415 / +91-9887992695