Data security is critical to maintaining data integrity and trust. That is why MarkLogic provides fine-grained, certified security that organizations require in order to shield against today’s cyber threats. With more advanced security features and certifications than any other NoSQL database, MarkLogic is considered the most secure NoSQL database. This is one of the reasons MarkLogic is chosen to run the most demanding, mission-critical applications at the heart of large investment banks, major healthcare organizations, and classified government systems.
The Common Criteria for Information Technology Security Evaluation (or “Common Criteria”) is an international standard for security by which vendors demonstrate their commitment and ability to provide security to their customers. Getting the certification is a rigorous process and is anything but common. You can learn more about the process of certification in this blog. The list of vendors with certification is short — and MarkLogic is the only NoSQL database to make this list.
Interested in a list of certified products? Visit the Common Criteria Portal, expand the section for “databases” and see where MarkLogic is listed.
MarkLogic is installed and operational on government systems with demanding security policies. These policies include stringent measures for access, authentication, management, audits, role separation, and system assurance. For example:
Additionally, customers have received Authority to Operate (ATO) for information systems utilizing MarkLogic that involve almost all of the major systems security standards. These standards continue to evolve and MarkLogic stays up to date on the latest changes (for example, SSAE 18 will soon replace SSAE 16). The system security standards currently in place on systems running MarkLogic include the following:
MarkLogic uses a document model to store data, and each document is governed by specific roles and permissions. By default, MarkLogic uses a role-based access control (RBAC) security model in which each user is assigned any number of roles, and these roles are associated with any number of privileges and permissions. Privileges govern the creation of documents and execution of functions (URI and execute privileges) and permissions govern what can be done with a document (read, insert, update, execute). Security checks verify the necessary credentials before granting the requested action, and security information is stored in a specific security database in MarkLogic.
Advanced encryption protects against unauthorized access of the database by a SysAdmin or Storage Admin. It allows data, configuration, and logs to be encrypted while the files are resting on disk using AES-256 encryption, and it conforms to FIPS 140 criteria. With the security add-on, you can also implement encryption using an external Key Management Systems (KMS).
Element level security provides access control at the level of JSON properties or XML elements within documents, regardless of schema. Specific information inside a document may be hidden from users based on their role, while still providing access to other information in the document. Element level security is akin to “cell-level” security in relational databases.
MarkLogic closely monitors database activity and makes it possible to audit document access and updates, configuration changes, administrative actions, code execution, and changes to access control.
MarkLogic supports external authentication using Lightweight Directory Access Protocol (LDAP) or Kerberos. MarkLogic also supports strong certificate-based authentication in Public Key Infrastructure (PKI).
MarkLogic can also employ other security models, such as Attribute-Based Access Control (ABAC), Policy-Based Access Control (PBAC), or Label-Based Access Control (LBAC). These models further restrict access based on attributes (e.g., social security number, IP address, user’s age, or time of day), policies, or simple labels representing “high” or “low” levels of trust.
Out-of-the-box, MarkLogic provides you with the industry-leading security you need. But your organization may require the Advanced Security add-on, which includes three additional capabilities.
Redaction eliminates the exposure of sensitive information by making it possible to remove existing information or replace it with other values when exporting data or sharing. The process is simple, flexible, and is designed to work with large volumes of data.
This options makes it possible to use an external KMS (e.g., SafeNet or Vormetric) to help with advanced encryption, which is often done for the additional separation of concerns and ease of management.
With compartment security, more complex rules can be applied to documents so that a user must have all of the right roles to access or create a document rather than just one of the rights roles. This is often useful when handling classified material.