Skip to content

Commit ad0f6a6

Browse files
davidhou17davidhou17
authored
(DOCSP-46047): Updates to Data Encryption Page (#67)
* first draft * add new diagrams + additional context * copy edits
1 parent 2e4b0a3 commit ad0f6a6

File tree

6 files changed

+2688
-40
lines changed

6 files changed

+2688
-40
lines changed

‎snooty.toml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -203,6 +203,7 @@ bic-short-no-link = "BI Connector"
203203
bic = "BI Connector for Atlas"
204204
bcp = "Backup Compliance Policy"
205205
bson = ":abbr:`BSON (Binary Javascript Object Notation)`"
206+
byok = ":abbr:`BYOK (Bring Your Own Key)`"
206207
c2c = "`Cluster-to-Cluster Sync <https://www.mongodb.com/docs/cluster-to-cluster-sync/current/>`__"
207208
c2c-limitations = "`Cluster-to-Cluster Sync Limitations <https://www.mongodb.com/docs/cluster-to-cluster-sync/current/reference/limitations/#limitations>`__"
208209
c2c-verification = "`Cluster-to-Cluster Sync Verification of Data Transfer <https://www.mongodb.com/docs/cluster-to-cluster-sync/current/reference/verification/>`__"

‎source/data-encryption.txt

Lines changed: 150 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -12,59 +12,169 @@ Data Encryption
1212
:depth: 2
1313
:class: onecol
1414

15-
|service| offers encryption features to protect data while in transit, at rest,
16-
and in use to safeguard data through its full lifecycle.
15+
|service| offers several encryption features to protect data
16+
while in transit, at rest, and in use to safeguard data through
17+
its full lifecycle.
1718

18-
{+service+} Features and Recommendations for Data Encryption
19-
------------------------------------------------------------
20-
21-
Features
22-
~~~~~~~~
19+
Features for Data Encryption
20+
----------------------------
2321

2422
Encryption in Transit
25-
`````````````````````
23+
~~~~~~~~~~~~~~~~~~~~~
24+
25+
Encryption in transit secures data during transmission between
26+
clients and servers, ensuring that your data cannot be inspected
27+
while in motion. In |service|, all network traffic to {+clusters+} is
28+
protected by Transport Layer Security (TLS), which is enabled by default
29+
and cannot be disabled. Data transmitted to and between nodes is encrypted
30+
in transit using TLS, ensuring secure communication throughout.
31+
32+
You can select which TLS version to use in |service|.
33+
TLS 1.2 and a minimum key length of 128 bits are the recommended default settings.
34+
All encryption in transit is supported by the
35+
OpenSSL :abbr:`FIPS (Federal Information Processing Standards)` Object Module.
2636

27-
Encryption in transit secures data during transmission between clients and servers,
28-
ensuring that your data cannot be inspected while in motion.
29-
In |service|, all network traffic to {+clusters+} is protected by Transport Layer
30-
Security (TLS) 1.2+, which is enabled by default and cannot be disabled.
31-
Data transmitted to and between nodes is encrypted in transit using TLS, ensuring secure communication throughout.
37+
.. figure:: /includes/images/encryption-in-transit.svg
38+
:figwidth: 750px
39+
:alt: An image showing encryption in transit with TLS between client applications and MongoDB Atlas.
3240

3341
Encryption at Rest
34-
``````````````````
42+
~~~~~~~~~~~~~~~~~~
3543

36-
Encryption at rest ensures that all data on disk are encrypted.
37-
In |service|, customer data is automatically encrypted at rest.
38-
This process utilizes your cloud provider's disk encryption, with the provider managing the encryption keys. This process cannot be disabled.
39-
Additionally, you have the option to enable database-level encryption, allowing you to use :ref:`your own encryption keys <security-kms-encryption>`
40-
with AWS Key Management Service (KMS), Google Cloud KMS, or Azure Key Vault.
44+
Encryption at rest ensures that all data on disk is encrypted
45+
and only visible once decrypted by an authorized process or
46+
application. In |service|, customer data is automatically encrypted
47+
at rest using AES-256. This process utilizes your cloud provider's
48+
disk encryption, with the provider managing the encryption keys.
49+
This process cannot be disabled.
4150

42-
In-use Encryption
43-
`````````````````
51+
Additionally, you have the option to enable database-level encryption
52+
by "bringing your own key" (BYOK) with a key management service (KMS).
53+
|byok| encryption adds another layer of security for additional
54+
confidentiality and data segmentation:
4455

45-
Encryption in use secures data while it's being processed.
46-
MongoDB has two features for encryption in use to meet your data protection needs: Client-Side Field-Level Encryption and Queryable Encryption.
56+
.. figure:: /includes/images/byok-encryption.svg
57+
:figwidth: 750px
58+
:alt: An image showing encryption at rest with an additional customer-managed key.
4759

48-
Client-Side Field-Level Encryption
49-
##################################
60+
To learn more about using your own encryption keys with
61+
AWS Key Management Service (KMS), Google Cloud KMS, or
62+
Azure Key Vault, see :ref:`security-kms-encryption`.
5063

51-
:ref:`Client-Side Field-Level Encryption <manual-csfle-feature>` (CSFLE) is an in-use encryption capability
52-
that enables a client application to encrypt sensitive data before storing it in the MongoDB database.
53-
Sensitive data is transparently encrypted, remains encrypted throughout its lifecycle, and is only decrypted on the client side.
64+
Encryption in Use
65+
~~~~~~~~~~~~~~~~~
5466

55-
Queryable Encryption
56-
####################
67+
Encryption in use secures data while it's being processed.
68+
MongoDB has two features for encryption in use to meet your data protection
69+
needs: Client-Side Field-Level Encryption and Queryable Encryption.
5770

58-
:ref:`Queryable Encryption <qe-manual-feature-qe>` helps organizations protect sensitive data when it is queried.
59-
It allows applications to encrypt sensitive data on the client side, securely store it in the database, and perform equality
60-
and range queries directly on the encrypted data.
61-
This ensures protection for sensitive information without sacrificing the ability to perform queries on it.
71+
Client-Side Field-Level Encryption
72+
``````````````````````````````````
73+
74+
:ref:`Client-Side Field-Level Encryption <manual-csfle-feature>` (CSFLE)
75+
is an in-use encryption capability that enables a client application to encrypt
76+
sensitive data before storing it in the MongoDB database. Sensitive data is
77+
transparently encrypted, remains encrypted throughout its lifecycle, and is
78+
only decrypted on the client side.
79+
80+
You can selectively encrypt individual fields within a document,
81+
multiple fields within the document, or the entire document. You can optionally
82+
secure each field with its own key and decrypt them seamlessly
83+
on the client by using a MongoDB driver. CSFLE uses AES-256 in
84+
authenticated CBC mode to encrypt data.
85+
86+
The following diagram demonstrates a CSFLE workflow where user records
87+
are stored in a MongoDB database and queried by the client. The user's
88+
social security number (SSN) is encrypted before being stored in the
89+
database. When the application submits a basic equality query on the field,
90+
the MongoDB driver uses the key to encrypt the query and decrypt the query results,
91+
before returning them to the authenticated client as readable plaintext.
92+
93+
.. figure:: /includes/images/csfle-encryption.svg
94+
:figwidth: 750px
95+
:alt: An image showing an example client-side field-level encryption (CSFLE) workflow.
6296

63-
Recommendations
97+
Queryable Encryption
98+
````````````````````
99+
100+
:ref:`Queryable Encryption <qe-manual-feature-qe>` helps organizations
101+
protect sensitive data when it is queried. Like CSFLE, it allows applications
102+
to encrypt your data on the client side before storing it in the MongoDB database.
103+
It also enables applications to perform expressive queries directly on the
104+
encrypted data by using an encrypted search algorithm. This ensures protection
105+
for sensitive information without sacrificing the ability to perform queries on it.
106+
107+
Queryable encryption uses AES-256 in authenticated CBC mode
108+
to encrypt data, and uses a combination of AES-256, SHA2, and HMACs
109+
for its encrypted search algorithm.
110+
111+
The following diagram demonstrates a queryable encryption workflow where
112+
user records are stored in a MongoDB database and queried by the client.
113+
The user's date of birth (DOB) is encrypted before being stored in the
114+
database. When the application submits an expressive range query on the field,
115+
the MongoDB driver uses the key to encrypt the query and passes a cryptographic token
116+
with it to the MongoDB server. The server uses the encrypted search algorithm
117+
to process the query without knowing the actual data. Finally, the driver uses the
118+
key to decrypt the query results and returns them to the authenticated
119+
client as readable plaintext.
120+
121+
.. figure:: /includes/images/queryable-encryption.svg
122+
:figwidth: 750px
123+
:alt: An image showing an example queryable encryption workflow.
124+
125+
Recommendations for Data Encryption
126+
-----------------------------------
127+
128+
Consider the following security recommendations when
129+
provisioning your {+clusters+}.
130+
131+
BYOK Encryption
64132
~~~~~~~~~~~~~~~
65133

66-
For development and testing environments, do not enable added encryption with :ref:`your own encryption keys <security-kms-encryption>` through AWS Key Management Service (KMS), Google Cloud KMS, or Azure Key Vault. This saves costs in your
67-
non-production environments.
68-
69-
For staging and production environments, enable added encryption with :ref:`your own encryption keys <security-kms-encryption>` through AWS Key Management Service (KMS), Google Cloud KMS, or Azure Key Vault for
70-
additional security.
134+
For staging and production environments, we recommend that you enable :ref:`BYOK
135+
encryption <security-kms-encryption>` through AWS Key Management Service (KMS),
136+
Google Cloud KMS, or Azure Key Vault when provisioning your {+clusters+}
137+
to avoid relying on application development teams to configure it later on.
138+
This also ensures consistent data protection across your environments.
139+
140+
For development and testing environments, consider skipping |byok| encryption
141+
to save costs. However, if you're storing sensitive data in |service|,
142+
such as for healthcare or financial services industries, consider enabling
143+
|byok| encryption in development and testing environments as well.
144+
145+
Data Classification
146+
~~~~~~~~~~~~~~~~~~~
147+
148+
During the provisioning process, we also recommend assessing the
149+
sensitivity of certain fields in your data and classifying
150+
them to determine which data requires encryption and what global
151+
restrictions to apply to these groups.
152+
153+
Consider the following data classification levels as a guideline:
154+
155+
- **Public Data**: Data that represents little to no
156+
risk to the company if unauthorized disclosure, alteration,
157+
or destruction of data occurs. While confidentiality is
158+
less of a concern, you should still apply authorization controls to
159+
prevent unauthorized modification or destruction of public data.
160+
161+
Examples: Products, Brochures, Training Information
162+
163+
- **Private Data**: Data that represents a moderate
164+
risk to the company if unauthorized disclosure, alteration,
165+
or destruction of data occurs. By default, all
166+
institutional data that is not explicitly classified as restricted or
167+
public data should be treated as private data.
168+
Apply CSFLE or queryable encryption on any fields that
169+
carry private data such as {+PII+}.
170+
171+
Examples: Customer Information, Contracts, Product Costs
172+
173+
- **Restricted Data**: Data that represents significant
174+
risk to the company if unauthorized disclosure, alteration,
175+
or destruction of data occurs. Apply the highest
176+
level of security controls to restricted data, including
177+
CSFLE or queryable encryption on all fields and
178+
|byok| encryption for additional security.
179+
180+
Examples: Revenue information, Payroll, Security Risks

‎source/includes/images/byok-encryption.svg

Lines changed: 1 addition & 0 deletions
Loading

0 commit comments

Comments
 (0)