NoSQL · Data models beyond tables
How do you secure a NoSQL database?
Short answer
Require authentication, apply least-privilege authorisation, encrypt in transit and at rest, isolate the network, validate input, rotate credentials and audit access. Never expose the database directly to the public internet.
Security is layered. Network controls limit who can reach the database, identity controls decide who can do what, and encryption protects data if a disk or backup is exposed. Auditing gives you a record when something goes wrong.
The baseline
- Authentication with strong credentials or workload identity, not shared admin users
- Role-based authorisation scoped to the collections, tables or keys the service needs
- TLS for client and inter-node traffic
- Encryption at rest, including backups
- Private networking, security groups or VPC endpoints
- Audit logging for administrative and sensitive data access
db.createUser({
user: "orders_service",
pwd: passwordPrompt(),
roles: [
{ role: "readWrite", db: "orders" }
]
});
db.grantRolesToUser("orders_service", [
{ role: "read", db: "catalog" }
]);Validate and parameterise input. NoSQL injection happens when user input is concatenated into a query document, for example turning a login filter into an always-true condition. Use the driver parameter binding and reject unexpected operators in request payloads.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What does least privilege look like for a service account?
- 2How can NoSQL injection happen with JSON queries?
- 3Why is encryption at rest not enough on its own?
- 4How would you rotate database credentials without downtime?
Say it in the interview
I layer network isolation, authentication, least-privilege authorisation, TLS and encryption at rest, plus audit logging. Each service gets its own identity with only the permissions it needs, and secrets live in a secret manager with rotation. I also validate input and use driver parameter binding, because concatenating user input into a query document enables injection. Encryption alone is not enough if an attacker can authenticate, so identity and network controls come first.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live NoSQL mock interview and get scored feedback on depth, clarity and confidence.