An excerpt from the White Paper "Introduction to Encrypting Data in MongoDB".
In fewer than ten years, MongoDB has risen to become a top player in nonrelational database providers, outcompeting and upsetting database monoliths such as OracleDB and Microsoft SQL Server. Built on a model of low up-front operational costs alongside improved performance, MongoDB has become one of the most widely growing databases for organizations across retail, financial, healthcare, and government entities.
Beyond cost and performance, a key component of MongoDB’s toolset is a robust plan to help customers achieve strong data security through encryption of data in flight and at rest, along with options to secure and manage encryption keys to meet industry compliance requirements and meet data security best practices.
If you are an organization who routinely considers security and compliance when purchasing third-party software, built-in security solutions can be hugely beneficial to your security and compliance strategy. However, like any new software, questions around deployment and how to get the most out of native encryption tools may still be a barrier to your success.
In order to paint both a broad and in-depth picture of how to best deploy encryption and encryption key management in MongoDB, let’s first start by discussing your options to encrypt data in your MongoDB database. If you’d like to first learn the fundamentals of encryption and key management before diving in, check out The Definitive Guide to Encryption Key Management Fundamentals.
Encrypting data in MongoDB
If you choose to encrypt your data, MongoDB offers solutions for encrypting data in motion as well as at rest.
Data-in-Motion Encryption
For securing data in motion, all versions of MongoDB support TLS (Transport Layer Security) and SSL (Secure Socket Layer) to send and receive data over networks. TLS and SSL are the types of encryption commonly used to secure website traffic and file sharing. They are cryptographic protocols that secure data while it is traveling from one point to another; however, before the data is sent and after the data arrives at its endpoint, the data appears unencrypted, or “in the clear”. MongoDB provides ample documentation on how to configure TLS and SSL protocols using certificates and public and private key pairs, also called asymmetric key systems. (Resource: TLS/SSL Configuration for Clients)
When considering encryption, enterprise customers must be aware of governmental and private regulations that require protecting sensitive information. For example, the Payment Card Industry (PCI) requires that credit card numbers be encrypted in storage. The HIPAA medical regulations require protection of Electronic Protected Health Information (ePHI). And there are many other regulations that require proper protection of Personally Identifiable Information (PII). A challenge for MongoDB users is that it is often difficult to know when sensitive information is being added to the database. The safe security strategy is to always encrypt the MongoDB database and use proper key management.
Data-at-Rest Encryption
To encrypt data at rest, MongoDB Enterprise offers native storage-based file symmetric key encryption, which means that users can use transparent data encryption (TDE) to encrypt whole database files at the storage level. First offered in version 3.2, MongoDB utilizes the Advanced Encryption Standard (AES) 256-bit encryption algorithm, an encryption cipher which uses the same secret key to encrypt and decrypt data. MongoDB also provides the option to turn encryption on in “FIPS mode”, which means the encryption you use in MongoDB is built to meet the highest standard and meet compliance. The Federal Information Processing Standard (FIPS) is a National Institute of Standards and Technology (NIST) validation that demonstrates your encryption algorithm has undergone rigorous tests. The NIST FIPS validation is often required for government and Department of Defense contractors; however, today NIST-validated AES encryption is considered an industry standard and is typically recommended or required by most industry-based compliance regulations. Data at rest encryption is only available on MongoDB Enterprise and Atlas editions using the required WiredTiger storage engine.
When encrypting data natively using TDE, it is important to know how encryption keys are stored in MongoDB. When a database file is encrypted, a unique, private encryption key is generated. Each encrypted database file generates a new private symmetric key, and all keys in your storage device are encrypted using a master key. While the database keys are stored alongside the encrypted data, the MongoDB never allows the master key to be stored on the same server as the encrypted data. This means that the database or security administrator must identify a secure storage location for the encryption key. MongoDB strongly recommends a third-party enterprise key management solutions; however, users have the option to store the key locally using a keyfile. This second option is extremely risky, and almost never recommended for key protection.
For even more information, view our Definitive Guide to MongoDB Encryption & Key Management.
To download this White Paper in it’s entirety, download “Introduction to Encrypting Data in MongoDB” and learn about Encrypting data-at-rest and in-motion in MongoDB, MongoDB vs SQL encryption, encryption performance, and what is key management.
