Table of Contents
URL: https://www.progressiverobot.com/mongodb-security-weighing-your-implementation-options/
Maintaining a MongoDB database and keeping it secure is no small task, but by following the recommendations highlighted throughout this series you can reduce the number of your database's vulnerabilities. WIth that said, the subject of securing a MongoDB database goes far beyond what could be discussed in a series like this one. Attackers are becoming more sophisticated every day, meaning that a database system could still become compromised even if it had been secured with all of the recommendations and features highlighted here.
As MongoDB has grown more popular, a number of cloud companies have launched their own managed MongoDB database service. A managed database, sometimes referred to as *database-as-a-service* or *DBaaS*, is a cloud computing service in which the end user pays a cloud service provider for access to a database.
Unlike a self-managed database, users don’t have to set up or maintain a managed database on their own; rather, it’s the provider’s responsibility to oversee the database’s infrastructure. Likewise, the cloud provider takes on much of the responsibilities related to keeping the database secure. Oftentimes the provider will deploy the database behind a firewall they control, and may require that any remote connections be made over TLS.
A common feature among managed database services is that they provide automatic backups as a form of disaster recovery. Many also ensure high availability and failover through automatic replication. However, as with any cloud service, by using a managed database you're giving up much of the control that comes with the "roll-your-own" approach of overseeing all aspects of the database yourself.
[info]
the cloud provider now offers its own managed MongoDB service that comes with a number of helpful security features. For example, the cloud provider Managed MongoDB Databases require connections to be made over TLS/SSL, ensuring that your data remains encrypted as it traverses the network. The data held in a Managed MongoDB Database is also encrypted at rest through the Linux Unified Key Setup, so you can rest assured that your data will be protected from unauthorized users.
You can deploy a the cloud provider Managed MongoDB Database with standby nodes. In the event of a failure, the service will switch data handling over to a standby node, helping to keep your data highly available. And after spinning up a MongoDB database managed by the cloud provider, you can secure it by restricting inbound connections to specific Droplets, Kubernetes clusters, or tags. You can even spin up a Mongo database within a Virtual Private Cloud, ensuring that your data is only accessible to resources within a trusted network.
If you work for a large company that uses MongoDB, it might be helpful to hire one or more full time database administrators or an outside consultant database administrator to help you consider which of MongoDB's security features makes the most sense for you to implement. You might even consider MongoDB's Enterprise edition, which includes advanced security features like Kerberos authentication and built-in auditing. However, the Enterprise Edition requires a paid subscription and still requires careful administration and oversight.
