RE: Vulnerability Assessment of a EAL 4 system

This is one of the only Linux Distro's in production certified for
EAL4...

"Following in the wake of its previous certifications, Novell's SUSE
Linux Enterprise Server 9 has achieved EAL4 certification on 'an IBM
eServer.' This puts SLES9 in the same league as Windows 2000 for sales
in the government sector and is the first Linux distro to achieve an
EAL4 certification."

Here is more support....
http://en.wikipedia.org/wiki/Evaluation_Assurance_Level

If you have a current EAL level 4 certified system and it is in
production, it means nothing to the extent other than you have a very
expensive piece of hardware.  Can you secure it?  If you are looking for
this answer then my suggestion is to run a series of PenTests against it
and see.  Rapid7 or CoreImpact or Metasploit or any number of system
Vulnerability scanners.  If something pops as a finding then address it
and move on.  But the certification for eal4 doesn't mean anything
unless you know how to secure the device... That's the bottom line.

Kawika

"Regret for the things we did can be tempered by time; it is regret for
the things we did not do that is inconsolable." -Sydney J. Harris 

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of [email protected]
Sent: Wednesday, November 01, 2006 5:12 AM
To: [email protected]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4
system by IBM.  During the assessment, I was looking for standard Linux
protections like iptables, ssh etc.  On this server, there is no
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system.  What do you need to look for in the EAL 4 system in
production that could become vulnerable?

Thank you in advance for any help.
-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of [email protected]
Sent: Wednesday, November 01, 2006 5:12 AM
To: [email protected]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4
system by IBM.  During the assessment, I was looking for standard Linux
protections like iptables, ssh etc.  On this server, there is no
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system.  What do you need to look for in the EAL 4 system in
production that could become vulnerable?

Thank you in advance for any help.