trademark

2.0 Security Best Practices for Non-Relational Data Stores (cont.)
Management Guide SP800-92 [KS06] and ISO27002 [ISO05].
• Use advanced persistent threat (APT) logging mechanisms like log4j, etc. For example, ELK
Stack (Elasticsearch, Logstash, Kibana) and Splunk can be used for log monitoring and onthe-fly
log analysis.
2.6 Apply fuzzing methods for security testing
2.6.1 Why?
To expose possible vulnerabilities caused by insufficient input validation in NoSQL that
engages hypertext transfer protocol (HTTP) to establish communication with users (e.g.,
cross-site scripting and injection).
2.6.2 How?
• Provide invalid, unexpected or random inputs and test for them. Typical strategies
include dumb fuzzing, which uses completely random input, and smart fuzzing, which
crafts input data based on knowledge about the input format, etc.
• Guidelines are provided by the Open Web Application Security Project (OWASP)
(https://www.owasp.org/index.php/Fuzzing), MWR InfoSecurity (https://www.
mwrinfosecurity.com/our-thinking/15-minute-guide-to-fuzzing/), etc. Fuzzing should
be done at separate levels in a system, including the protocol level, data node level,
application level, and so forth.
• Use tools for fuzzing, such as Sulley.
2.7 Ensure appropriate data-tagging techniques
2.7.1 Why?
To avoid unauthorized modification of data while piping data from its source.
2.7.2 How?
Use security-tagging techniques that mark every tuple arriving on a specified data source
with a special, immutable security field including timestamp.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
15