Any outfit, large or small, generates huge amounts of data that need efficient storage. All the data together organized to form a definite structure is called a database, while the application used to manage the database is known as a database management system or DBMS. DBMS empowers the user to enter, change and access individual datum in the database. There are two ways the data is usually stored – using a relational database or a non-relational database.
The easiest way to differentiate between the two is by saying that the first one stores data in a table format while the latter does it in a hierarchical format. Relational databases store the data in rows and it is defined through the columns, while indices are used for easier access and management of the data in the database.
NoSQL Databases
The standard language for relational DBMS is SQL or Structured Query Language. Drawing from this, non-relational databases came to be referred to as NoSQL databases. A non-relational database is best used when you are developing a database without having a clear idea about the different categories the data would form or what data might be added later on.
Thus, it is most useful when wanting to store non-relational, scalable data. MongoDB is one such database provider. Its powerful features have raised it through the rungs of the database ladder in the world of database management. And if you are looking for a MongoDB development company consider consulting with Smart Sight Innovations.
Encrypting Data in MongoDB
When encrypting data in a non-relational database, there are two options for the users. The first is the encryption of data at the application level and the other is at the database level. When encrypting data at the application level, you perform the encryption before entering the data into the database. But, data encryption at the database level means encrypting the whole database at once. It is pretty clear that application-level encryption would need far more processing and, naturally, be more expensive than database encryption, since it will have to run the encryption procedure each time any data is entered. This could be thousands or even millions of times a day, depending on the size of the organization and the level of activity it records every day.
That is why most organizations usually go with database-level encryption, even though application-level encryption is more secure. The organizations must ensure that all encryption and security measures taken must comply with data security regulations put in place by government and private authorities such as PCI-DSS, FERPA, HIPAA and HITECH. Many databases do not provide the encryption feature and organizations have to buy third-party encryption for their databases. But the good news for MongoDB users is that MongoDB does have a native-level database encryption feature and so, it need not be bought separately. Let us look at how MongoDB encrypts data-in-transit and data-in-rest.
Data-in-Motion Encryption
Data-in-motion refers to the data that is being transferred from one place to another. This is generally considered to be the time when data is least secure. That is why, it is very important to use robust, verified encryption methods to protect the data, especially data related to critical business processes.
MongoDB uses TLS and SSL encryption to protect data-in-motion, which are the most popular cryptographic protocols for sending data over a network. As a result, connections are encrypted to mongod and mongos instances to prevent any third party from reading the data while in transit. It can also be used to authenticate the identity of the client.
Since data-in-motion is more vulnerable to security breaches, they are protected using asymmetric key system, wherein two separate keys are used at the encryption and decryption points, respectively the public and the private key. Certificates like PEM files must also be used, preferably issued by a certificate authority, for server identity verification.
Data-at-Rest Encryption
MongoDB started offering native data-at-rest encryption from version 3.2 in the Enterprise and Atlas editions. WiredTiger is the only encrypted storage engine option provided. MongoDB uses AES256 (Advanced Encryption Standard 256 bit) encryption cipher algorithm, which is based on the symmetric key system, i.e., a single encryption key is used to both encrypt and decrypt the data. By, default, the model used is AES256-CBC (Cipher Block Chaining) in MongoDB Enterprise. AES256-GCM (Galois/Counter Mode) is also available in MongoDB Enterprise, but since the introduction of version 4.0, it is supported only in Linux. You can also choose to run it in the NIST FIPS mode, which ensures the highest possible standard for encryption.
MongoDB uses TDE or Transparent Data Encryption. This means that besides encrypting the data in the database, it also encrypts the entire database for an extra layer of security. When you encrypt a single database page or file, a new specific private encryption key is generated, which happens for every file that is encrypted. These encryption keys are then further encrypted to generate a master encryption key for the entire database. The database itself and the individual encryption keys may be stored on the native servers of the administrator.
MongoDB has its own regulations in place so as to prevent the storage of the master key in the same server. So the administrator-level user or users have two options to make the master key external to the native server. The first is to avail a third-party enterprise key management solution to provide a different server or store it in a key file. The latter poses high risks and thus, is not recommended by MongoDB itself.
Encryption Performance in MongoDB
Adding encryption to a database, although highly important, does make the management of the database a bulky process. This is because every time someone has to access a datum or make any changes to it, the data will have to be decrypted, worked with and then again encrypted. This obviously reduces the speed of data management. However, this is only a small price to pay for the enhanced security, which is far more essential.
MongoDB encryption performance was tested over the Intel Xeon X5675 CPU. As mentioned before, MongoDB uses the WiredTiger encrypted storage engine, which displayed a latency of 10-20% when used at its highest load. However, when the load was reduced, for example, when only read functions were performed, the latency decreased to 5-10%. WiredTiger, however, is one of the most powerful engines in terms of performance, security and scalability. Further, data encryption occurs at page-level instead of at a database-level, thus reducing the amount of encryption that must be performed each time a datum needs to be accessed.
Encryption Key Management in MongoDB
Encryption key management is important to protect your data. There is no point in locking your house if you keep the key in plain sight. Similarly, without effective encryption key management, encryption itself is useless. MongoDB complies with all enterprise key management rules that NIST has set in its SP-800-130 and SP-800-57 Special Publications.
We already talked about key management by MongoDB in the section on TDE. Yet, it is important to know that MongoDB specifies KMIP or Key Management Interoperability Protocol for third-party key management providers. Make sure their server has NIST FIPS 140-2 as well as PCI certification for the highest level of security.
Of course, relying on your digital system does not ensure foolproof security of your database. Unless the administrators and users themselves practice discipline and stringency in maintaining the cybersecurity of their database, no amount of costly or high-security solutions will ensure safety of their database.
