The first step in securing a MongoDB database is to enable security. By default, a MongoDB database is without transport layer security mechanisms and without any role-based access controls. This is by design, otherwise how would you be able to access the database in order to make it secure? Also, not having to deal with authentication is convenient for initial application development and database document design. If you implement an unsecured database in a production environment, you might end up being unemployed!
Before moving into a discussion on how to enable security, it is important to gain an understanding of the MongoDB authentication process, and what forms of authentication are available.
For an excellent overview of the steps needed to properly secure a MongoDB database, in the MongoDB documentation, see the security checklist (https://docs.mongodb.com/manual/administration/security-checklist/#security-checklist).
Starting with MongoDB version 3.6...
