RE: Vulnerability Assessment of a EAL 4 system

You should get a copy of the security target and protection profiles
used for the EAL4 accreditation.  This will give you insight into what
they evaluated against. I would then suggest performing standard Linux
checks on the system (sounds like you already did some of that). Any
standard security protections missing need to be weighed against what
the vendor has done to provide similar protections. 


Thanks,

Ian Stong

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of [email protected]
Sent: Wednesday, November 01, 2006 5:12 AM
To: [email protected]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4
system by IBM.  During the assessment, I was looking for standard Linux
protections like iptables, ssh etc.  On this server, there is no
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system.  What do you need to look for in the EAL 4 system in
production that could become vulnerable?

Thank you in advance for any help.