RE: Vulnerability Assessment of a EAL 4 system

I guess what everyone is trying to says is that just because a device / 
OS combination has been tested to EAL4 doesn't mean your version is 
configured as such. 

-----Original Message-----
From: Takayama Kawika (DTI) [mailto:[email protected]] 
Sent: 02 November 2006 09:44
To: [email protected]
Subject: RE: Vulnerability Assessment of a EAL 4 system

This is one of the only Linux Distro's in production certified for 
EAL4...

"Following in the wake of its previous certifications, Novell's SUSE 
Linux Enterprise Server 9 has achieved EAL4 certification on 'an IBM 
eServer.' This puts SLES9 in the same league as Windows 2000 for sales 
in the government sector and is the first Linux distro to achieve an
EAL4 certification."

Here is more support....
http://en.wikipedia.org/wiki/Evaluation_Assurance_Level

If you have a current EAL level 4 certified system and it is in 
production, it means nothing to the extent other than you have a very 
expensive piece of hardware.  Can you secure it?  If you are looking for 
this answer then my suggestion is to run a series of PenTests against it 
and see.  Rapid7 or CoreImpact or Metasploit or any number of system 
Vulnerability scanners.  If something pops as a finding then address it 
and move on.  But the certification for eal4 doesn't mean anything 
unless you know how to secure the device... That's the bottom line.

Kawika

"Regret for the things we did can be tempered by time; it is regret for 
the things we did not do that is inconsolable." -Sydney J. Harris 

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of [email protected]
Sent: Wednesday, November 01, 2006 5:12 AM
To: [email protected]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4 
system by IBM.  During the assessment, I was looking for standard Linux 
protections like iptables, ssh etc.  On this server, there is no 
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system.  What do you need to look for in the EAL 4 system in 
production that could become vulnerable?

Thank you in advance for any help.
-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of [email protected]
Sent: Wednesday, November 01, 2006 5:12 AM
To: [email protected]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4 
system by IBM.  During the assessment, I was looking for standard Linux 
protections like iptables, ssh etc.  On this server, there is no 
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system.  What do you need to look for in the EAL 4 system in 
production that could become vulnerable?

Thank you in advance for any help.