Marklogic hero hex top

Advanced Security Features

Just because protecting and securing your data against today’s cyber threats is critical doesn’t mean you have to limit access. With MarkLogic you can have fine-grained access controls, proper separation of duties, and the ability to anonymize data so that your data is both secure and shareable.

The Best of Both Worlds: Shareability & Security

Out of the box, MarkLogic provides you with the industry-leading security you need.
But your organization may require the Advanced Security option, which includes three additional capabilities:

  • External Key Management for additional separation of concerns and ease of management for storing encryption keys. This option is helpful when you want to leverage an external Key Management System (KMS) that is already in use.
  • Redaction for when pieces of your data need to be removed or obscured when exporting data for sharing. This feature is beneficial in meeting compliance guidelines like HIPAA, SEC17a-4, FINRA, and GDPR, to name just a few.
  • Compartment Security to further restrict data access by requiring users to have more than one role to view data, not just one of the right roles. It’s often employed to protect classified material in government systems.
MarkLogic Server - Advanced Security

Our Customers Say It Best

There's a whole new way of defining security and what it means to have data ownership. You can have shared infrastructure, and I can define security models in a way where different groups in the organization can have access to their own data, but we still have one copy of the data.

Pranav Rao Head of Technology, Asset Management - Credit Suisse

We need to have a sense of unified data available, govern it properly, and apply security to make sure that we can share that knowledge throughout our organization. So, we are utilizing MarkLogic to break away from the silo approach—we have a unified sense of data and can also enforce proper controls over it and empower our employees to access the data.

Sema Ustuntas Senior Enterprise Architect - Boeing

External Key Management

MarkLogic interoperates with third-party KMS systems, including Amazon Web Services (AWS) Key Management Service (KMS) and others such as Gemalto’s SafeNet.

These external KMS systems securely manage authentication keys used by the self-encrypting disks in your storage system. This extra layer of security includes:

Key Management

for automatic key rotation, key revocation, and deletion.

Access Controls

so that unauthorized database admins, system admins, and storage admins can’t access the database files. Only the external KMS admin controls access to the encryption keys.

Redaction

Compartment Security

Compartment Security provides additional security control to specify that a user must have all of the right roles to interact with a document rather than just one of the right roles using AND semantics or OR semantics.

In MarkLogic, a compartment is a name associated with a role. When a role is compartmented, the compartment name is used as an additional check when determining a user’s authority to access or create documents in a database. Without compartment security, permissions are checked using OR semantics.

For example, if a document has read permission for role1 and read permission for role2, a user who possesses either role1 or role2 can read that document. If those roles have different compartments associated with them (for example, compartment1 and compartment2, respectively), then the permissions are checked using AND semantics for each compartment, as well as OR semantics for each non-compartmented role. To access the document, if role1 and role2 are in different compartments, a user must possess both role1 and role2 to access the document, as well as a non-compartmented role that has a corresponding permission on the document.

Learning & Resources

default datasheet thumbnail Data Sheet
Data Sheet

Advanced Security Datasheet

Learn more
MarkLogic Prefooter Banner

Ready to Get Started?

Our free Developer Edition is a full-featured version of MarkLogic Server for development use. Get access now and store up to 1TB of data.