diff --git a/source/core/security-introduction.txt b/source/core/security-introduction.txt index fae1b9fbc78..4df213a7127 100644 --- a/source/core/security-introduction.txt +++ b/source/core/security-introduction.txt @@ -85,20 +85,34 @@ See :doc:`/tutorial/configure-ssl` for more information. Encryption at Rest ~~~~~~~~~~~~~~~~~~ -MongoDB has a partnership with Gazzang to encrypt and secure sensitive -data within MongoDB. The solution encrypts data in real time, and Gazzang -provides advanced key management that ensures only authorized processes -can access this data. The Gazzang software ensures that the cryptographic -keys remain safe and ensures compliance with standards including HIPAA, -PCI-DSS, and FERPA. +There are two broad classes of approaches to encrypting data at rest with +MongoDB, which can be used independently or in concert: -For more information on the partnership, refer to the following resources: +One option is to provide encryption on a per-field or per-document basis within +the application layer, either by writing custom encryption and decryption +routines or by making use of commercial solutions such as the `Vormetric Data Security Platform `_. -- `Partnership `_ +The other is to use one of a number of third-party libraries that integrate with +the operating system to provide transparent disk-level encryption that ensures +that only authorized processes can access protected data. Examples of such +solutions include: -- `Datasheet `_ +- Linux Unified Key Setup (LUKS), which is available for most Linux + distributions and whose configuration is illustrated in `documentation from + Red Hat `_, -- `Webinar `_ +- `IBM Guardium Data Encryption `_, which provides support for disk-level + encryption under both the Linux and Windows operating systems, + +- The aforementioned `Vormetric Data Security Platform `_, which also provides + disk- and file-level encryption, and + +- `Bitlocker Drive Encryption `_, a feature available on Windows Server 2008 and 2012 that provides + disk encryption. + +Properly configured disk encryption, when used alongside good security policies +that protect relevant accounts, passwords, and encryption keys, can help ensure +compliance with standards such as HIPAA, PCI-DSS, and FERPA. Hardening Deployments and Environments --------------------------------------