We already covered a lot of important things that you will need to work efficiently with mongodb.
Now this mongodb course is built for developers,
therefore the things we're going to cover in this section are only partly important to you but well
they are at least partly important to you and security always matters.
So in this module, we'll take a look at something which is mainly the job of your database administrator
and not of you, the developer
but since you will play one important role in the overall picture of security and user authentication,
I find it important to guide you through the most important parts that are related to securing a mongodb
database.
There is kind of a security checklist which you also find in the official docs when it comes to hardening
your mongodb environment and making sure that it's safe and can't be intruded from outside.
One of the most important things is authentication and authorization
and this is already one of the things where you as a developer come into play, where you will have to worry
about
and I will show you how you do authorize and so on throughout this module and also later in the from shell to
driver module.
So authentication and authorization will be one important part and this part here or this topic mainly means
that the database,
so I'm not talking about the application you're building but the database you're using to store data
will know users and you will have to authenticate,
so you means you as a developer,
so your code will have to authenticate with that database in order to insert data, get data or do all
kinds of stuff.
So authentication and authorization is one super important building block when it comes to securing your
mongodb environment. Another important building block is transport encryption,
this means that data that is sent from your app to the server should be encrypted so that no one can
sit in the middle and spoof your connection and read that data.
Additionally encryption at rest is an important topic and that means that the data in the database
also should be encrypted otherwise if someone somehow gets access to your database servers, well they
can read plain text information and that will make getting the data out of there
easier. If you do encrypt your data in the database, you are still protected a bit even if people get access
to your database server because then they might have access but the data is unreadable.
These are three very important building blocks,
additional important building blocks are auditing. We'll not dive into this in this module or in this
course because this is a pure server admin task but of course mongodb does provide features to audit
your service,
so to see who did what, which actions occurred and you can do a lot of stuff there to make sure that
you always control what's happening and you always are aware of what's happening in your database.
Additionally the server on which you run your database server and now I'm talking about the physical
machine which is running somewhere or if you're using a cloud provider like AWS, I'm talking about the
instances you booked there, the network you are using to host your mongodb environment
of course also should be secured
and now that is also far beyond the scope of this course and far beyond what you as a developer have to
do
but if you are administrating and setting up the entire mongodb environment,
this is also something you will have to take care about.
And last but not least, backups and software updates also matter.
You and now again I don't mean you as a developer but you as the owner of a mongodb environment, you should
regularly backup your data
and of course you should make sure that all the software you're running is up to date to fix any security
holes that might be in there.
So these are important things, in this module we'll have a look at these three blocks because these three
blocks kind of affect your work as a developer and you will see how they affect your work in this module
and later
as I mentioned in the from shell to driver module. So let's dive in and let's start with authentication
and authorization and learn what exactly that is and how you use it.