Encryption in transit

As explained in MongoDB 8.0 in Action, Third Edition

Encryption in transit is the protection of data while it is transmitted across networks by encoding it against unauthorized disclosure or alteration.

Encryption in transit protects data while it crosses networks or moves between devices by preserving confidentiality and integrity against interception or modification, including man-in-the-middle attacks. section 20.5.1

Atlas applies this protection through several operational controls:

• Automatically secures all connections to MongoDB clusters with TLS, including traffic between Atlas cluster nodes. section 20.5.1
• Enables TLS by default and does not allow it to be disabled; TLS 1.2 is the recommended default, with a minimum 128-bit key length. section 20.5.1
• Uses OpenSSL FIPS Object Module practices for key generation, distribution, storage, replacement, and compromise response. section 20.5.1
• Assigns customers responsibility for configuring network connectivity and selected security settings, while MongoDB continuously enforces encryption controls. section 20.1

Atlas cluster communication

A client sending customer data to an Atlas cluster and nodes exchanging data within that cluster communicate over TLS-encrypted channels, while the cluster uses its selected TLS version and managed certificate and key controls. section 20.5.1

Figure 20.1 The shared responsibility model in Atlas divides security and operational tasks among customers, MongoDB, and the underlying cloud providers (AWS, GCP, and Azure). (Image © MongoDB 2024 CC BY-NC-SA 3.0)

Use the shared responsibility diagram to distinguish customer-controlled connectivity and security configuration from MongoDB and cloud-provider responsibilities. section 20.1

How MongoDB 8.0 in Action, Third Edition covers it

How deep it goes

Explains TLS defaults, version selection, key length, certificate trust, and key-management practices without detailing TLS negotiation internals.

Examples

Uses Atlas client connections, inter-node traffic, TLS 1.2, 128-bit minimum keys, trusted certificates, and OpenSSL FIPS controls.

What it assumes

Assumes an Atlas security context while defining TLS, transmission threats, and shared security responsibilities.

What you can do after

Operate Atlas securely by recognizing enforced TLS protection and selecting an appropriate TLS version for clusters.

How it connects

Connects TLS with man-in-the-middle attacks, key management, FIPS, network connectivity, and the shared responsibility model.

liveBookmanning.com

Read MongoDB 8.0 in Action, Third Edition on liveBook Get the book at manning.com

Related concepts

• TLSimplemented by · Transport Layer Security (TLS) is a cryptographic protocol that protects network communications through confidentiality, integrity, and authentication of communicating endpoints.
• TLS terminationcontrasts with · TLS termination is the process of ending a TLS connection and decrypting its traffic at an endpoint or intermediary for processing or forwarding.
• certificateuses · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• HTTPSuses · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.
• man-in-the-middle attackaddresses · A man-in-the-middle attack is a network attack in which an adversary intercepts, relays, impersonates, or alters communication between parties.
• virtual private networkused by · A virtual private network is a logical network that connects systems across an underlying network through protected, typically encrypted, communication.

This explainer was generated by Manning's knowledge graph from the text of MongoDB 8.0 in Action, Third Edition. The section links point to the parts of the book it draws on.