MongoDB Documentation, Release 3.0.4 Encryption at Rest Storage Encryption 6.1.5 Hardening Deployments and Environments 6.1.6 Additional Resources There are two broad classes of approaches to encrypting data at rest with MongoDB. You can use these solutions together or independently: Provide encryption on a per-field or per-document basis within the application layer. To encrypt document or field level data, write custom encryption and decryption routines or use a commercial solutions such as the Vormetric Data Security Platform$^{2}$. Encrypt all MongoDB data on the storage or operating system to ensure that only authorized processes can access protected data. A number of third-party libraries can integrate with the operating system to provide transparent disk- level encryption. For example: Properly configured disk encryption, when used alongside good security policies that protect relevant accounts, pass- words, and encryption keys, can help ensure compliance with standards, including HIPAA, PCI-DSS, and FERPA. In addition to implementing controls within MongoDB, you should also place controls around MongoDB to reduce the risk exposure of the entire MongoDB system. This is a defense in depth strategy. Hardening MongoDB extends the ideas of least privilege, auditing, and encryption outside of MongoDB. Reducing risk includes: configuring the network rules to ensure that only trusted hosts have access to MongoDB, and that the MongoDB processes only have access to the parts of the filesystem required for operation. • Making HIPAA Compliant MongoDB Applications 7 • Security Architecture White Paper 8 $^{2}$http://www.vormetric.com/sites/default/files/sb-MongoDB-Letter-2014-0611.pdf $^{3}$https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Encryption.html $^{4}$http://www-03.ibm.com/software/products/en/infosphere-guardium-data-encryption $^{5}$http://www.vormetric.com/sites/default/files/sb-MongoDB-Letter-2014-0611.pdf $^{6}$http://technet.microsoft.com/en-us/library/hh831713.aspx $^{7}$https://www.mongodb.com/blog/post/making-hipaa-compliant-applications-mongodb?jmp=docs $^{8}$https://www.mongodb.com/lp/white-paper/mongodb-security-architecture?jmp=docs 6.1. Security Introduction 319 Linux Unified Key Setup (LUKS) LUKS is available for most Linux distributions. For configuration explanation, see the LUKS documentation from Red Hat$^{3}$. IBM Guardium Data Encryption IBM Guardium Data Encryption 4 provides support for disk-level encryption for Linux and Windows operating systems. Vormetric Data Security Platform The Vormetric Data Security Platform 5 provides disk and file-level encryption in addition to application level encryption. Bitlocker Drive Encryption Bitlocker Drive Encryption 6 is a feature available on Windows Server 2008 and 2012 that provides disk encryption. Application Level Encryption