The Most Secure NoSQL Database
Data security is critical to maintaining data integrity and trust. That is why MarkLogic provides fine-grained, certified security that organizations require in order to shield against today’s cyber threats. With more advanced security features and certifications than any other NoSQL database, MarkLogic is considered the most secure NoSQL database. This is one of the reasons MarkLogic is chosen to run the most demanding, mission-critical applications at the heart of large investment banks, major healthcare organizations, and classified government systems.
More sharing with less risk
The Only NoSQL Database Common Criteria Certified
The Common Criteria for Information Technology Security Evaluation (or “Common Criteria”) is an international standard for security by which vendors demonstrate their commitment and ability to provide security to their customers. Getting the certification is a rigorous process and is anything but common. You can learn more about the process of certification in this blog. The list of vendors with certification is short — and MarkLogic is the only NoSQL database to make this list.
Interested in a list of certified products? Visit the Common Criteria Portal, expand the section for “databases” and see where MarkLogic is listed.
Additional Certifications and Audits
MarkLogic is installed and operational on government systems with demanding security policies. These policies include stringent measures for access, authentication, management, audits, role separation, and system assurance. For example:
- NIACAP (National Information Assurance Certification and Accreditation Process) – Developed by the U.S. intelligence community for certification and accreditation of computer and telecommunications systems that handle U.S. national-security information
- NIST Special Publication 800-37 – Guide for Applying the Risk Management Framework to Federal Information Systems; supports the six-step Risk Management Framework (RMF)
Additionally, customers have received Authority to Operate (ATO) for information systems utilizing MarkLogic that involve almost all of the major systems security standards. These standards continue to evolve and MarkLogic stays up to date on the latest changes (for example, SSAE 18 will soon replace SSAE 16). The system security standards currently in place on systems running MarkLogic include the following:
- NIST 800-53
- ICD 503
- FIPS 140-2
- HIPAA
- SOX 302/404
- FedRAMP
- SSAE 16
- EU 95/46/EC
Key Aspects of MarkLogic's Security
Role Based Access Control (RBAC)
MarkLogic uses a document model to store data, and each document is governed by specific roles and permissions. By default, MarkLogic uses a role-based access control (RBAC) security model in which each user is assigned any number of roles, and these roles are associated with any number of privileges and permissions. Privileges govern the creation of documents and execution of functions (URI and execute privileges) and permissions govern what can be done with a document (read, insert, update, execute). Security checks verify the necessary credentials before granting the requested action, and security information is stored in a specific security database in MarkLogic.
Advanced Encryption
Advanced encryption protects against unauthorized access of the database by a SysAdmin or Storage Admin. It allows data, configuration, and logs to be encrypted while the files are resting on disk using AES-256 encryption, and it conforms to FIPS 140 criteria. With the security add-on, you can also implement encryption using an external Key Management Systems (KMS).
Element Level Security
Element level security provides access control at the level of JSON properties or XML elements within documents, regardless of schema. Specific information inside a document may be hidden from users based on their role, while still providing access to other information in the document. Element level security is akin to “cell-level” security in relational databases.
Auditing
MarkLogic closely monitors database activity and makes it possible to audit document access and updates, configuration changes, administrative actions, code execution, and changes to access control.
External Authentication
MarkLogic supports external authentication using Lightweight Directory Access Protocol (LDAP) or Kerberos. MarkLogic also supports strong certificate-based authentication in Public Key Infrastructure (PKI).
Other Security Models
MarkLogic can also employ other security models, such as Attribute-Based Access Control (ABAC), Policy-Based Access Control (PBAC), or Label-Based Access Control (LBAC). These models further restrict access based on attributes (e.g., social security number, IP address, user’s age, or time of day), policies, or simple labels representing “high” or “low” levels of trust.
Advanced Security Add-Ons
Out-of-the-box, MarkLogic provides you with the industry-leading security you need. But your organization may require the Advanced Security add-on, which includes three additional capabilities.