MongoDB Documentation, Release 3.0.4 6.5.8 Run MongoDB with Secure Configuration Options MongoDB supports the execution of JavaScript code for certain server-side operations: mapReduce , group , and $where . If you do not use these operations, disable server-side scripting by using the --noscripting option on the command line. Use only the MongoDB wire protocol on production deployments. Do not enable the following, all of which enable the web server interface: enabled , net.http.JSONPEnabled , and net.http.RESTInterfaceEnabled . Leave these disabled , unless required for backwards compatibility. Keep input validation enabled. MongoDB enables input validation by default through the wireObjectCheck setting. This ensures that all documents stored by the mongod instance are valid BSON . The Security Technical Implementation Guide (STIG) contains security guidelines for deployments within the United States Department of Defense. MongoDB Inc. provides its STIG, upon request, for situations where it is required. Please request a copy 89 for more information. For applications requiring HIPAA or PCI-DSS compliance, please refer to the MongoDB Security Reference Architec- ture 90 to learn more about how you can use the key security capabilities to build compliant application infrastructure. 6.5.9 Request a Security Technical Implementation Guide (where applicable) 6.5.10 Consider Security Standards Compliance $^{89}$http://www.mongodb.com/lp/contact/stig-requests $^{90}$http://info.mongodb.com/rs/mongodb/images/MongoDB_Security_Architecture_WP.pdf 433 6.5. Security Checklist