Threat Models: Disk Theft, Cloud Admin, Database Admin, Application Compromise, and Log Leakage

Learning objectives

1. Start with the attacker, not the checkbox

“Encrypt the database” is not a threat model. A stolen disk, a cloud administrator, a MongoDB database administrator, a compromised application process, and a verbose application logger observe different boundaries. Encryption only helps when the attacker is outside the boundary that owns the decryption key.

2. Encryption layers protect different boundaries

TLS protects data in transit between endpoints. At-rest encryption protects storage media after the database process has obtained its storage key. Client-Side Field Level Encryption (CSFLE) encrypts selected BSON values in the client before they reach MongoDB. Queryable Encryption (QE) is also client-side but adds server-maintained encrypted metadata so supported queries can operate without revealing the plaintext field to the server. None of these replaces authentication, authorization, backup, or key recovery.

3. Make the edition boundary observable

The Community image should identify itself as Community. That evidence is important because native WiredTiger encryption at rest is an Enterprise capability outside Atlas. The lab does not “simulate Enterprise by renaming a flag”; it records the actual edition, then uses the later CSFLE/QE labs for Community-compatible client-side encryption.

docker rm -f atlasmart-ch23-l1 2>/dev/null || truedocker volume rm atlasmart-ch23-l1-db 2>/dev/null || truedocker run -d --name atlasmart-ch23-l1 \  -p 127.0.0.1:27181:27017 \  -v atlasmart-ch23-l1-db:/data/db \  mongodb/mongodb-community-server:8.3.8-ubuntu2204-slim \  --bind_ip_all --port 27017until mongosh "mongodb://127.0.0.1:27181/admin" --quiet --eval 'db.runCommand({ping:1}).ok' 2>/dev/null | grep -q 1; do sleep 1; donemongosh "mongodb://127.0.0.1:27181/admin" --quiet --eval '  printjson(db.adminCommand({buildInfo:1}));  printjson(db.adminCommand({getParameter:1,featureCompatibilityVersion:1}));' mongosh "mongodb://127.0.0.1:27181/atlasmart" --quiet --eval '  db.customers.insertOne({customerId:"C-2301",email:"alice@example.test",supportNote:"refund requested"});  printjson(db.customers.findOne({customerId:"C-2301"}));  const b=db.adminCommand({buildInfo:1});  printjson({version:b.version,modules:b.modules,allocator:b.allocator});' 

4. The deliberately wrong design: put keys beside ciphertext

If the application repository contains the local master key, database URI, and an encrypted data export together, one repository leak can collapse the intended trust separation. Likewise, encrypting a field but logging the original request body creates a plaintext copy outside the encrypted collection. The repair is to separate key custody from data custody and to inventory every secondary data path.

from dataclasses import dataclass@dataclassclass Surface:    name: str    plaintext: bool    key_present: boolsurfaces = [    Surface("mongodb data file", False, False),   # only true after CSFLE/QE    Surface("application memory", True, True),    Surface("request log", True, False),    Surface("key service", False, True),    Surface("analytics export", True, False),]for s in surfaces:    print(f"{s.name:20} plaintext={s.plaintext} key_present={s.key_present}")# The lab is an inventory aid, not an encryption implementation.

5. Production judgment

Choose encryption from an explicit attacker model. If disk theft is the threat, storage encryption and key custody matter. If the database administrator must not see a field, storage encryption is insufficient and client-side encryption is relevant. If the trusted application is compromised, a field key loaded into that process is no longer a boundary. Treat logs, caches, search/vector systems, backups, observability payloads, and data-science extracts as separate copies that need their own controls. The next lesson focuses specifically on the storage-key boundary and why Community, Enterprise, and Atlas must not be conflated.

Authoritative references

Version-, edition-, driver-, topology-, and preview-sensitive encryption behavior was checked against current MongoDB documentation at generation time. Re-check these sources before applying the procedure to a later release.

• MongoDB Encryption
• Configure Encryption at Rest
• Atlas Encryption at Rest
• Client-Side Field Level Encryption
• CSFLE Compatibility
• CSFLE Encryption Schemas
• Queryable Encryption
• Queryable Encryption Compatibility
• Queryable Encryption Features
• Queryable Encryption Supported Operations
• Encrypted Fields and Enabled Queries
• Create an Encryption Schema
• Explicit Queryable Encryption
• Queryable Encryption KMS Providers
• Rotate and Rewrap Encryption Keys
• Key Vault createKey
• Key Vault getKeyVault
• MongoClient Queryable Encryption Options
• PyMongo CSFLE Upgrade Requirements
• MongoDB 8.3 Release Notes
• mongosh Release Notes
• PyMongo Release Notes