I guess what everyone is trying to says is that just because a device /
OS combination has been tested to EAL4 doesn't mean your version is
configured as such.
-----Original Message-----
From: Takayama Kawika (DTI) [mailto:Kawika.Takayama@state.de.us]
Sent: 02 November 2006 09:44
To: focus-linux@securityfocus.com
Subject: RE: Vulnerability Assessment of a EAL 4 system
This is one of the only Linux Distro's in production certified for
EAL4...
"Following in the wake of its previous certifications, Novell's SUSE
Linux Enterprise Server 9 has achieved EAL4 certification on 'an IBM
eServer.' This puts SLES9 in the same league as Windows 2000 for sales
in the government sector and is the first Linux distro to achieve an
EAL4 certification."
Here is more support....
http://en.wikipedia.org/wiki/Evaluation_Assurance_Level
If you have a current EAL level 4 certified system and it is in
production, it means nothing to the extent other than you have a very
expensive piece of hardware. Can you secure it? If you are looking for
this answer then my suggestion is to run a series of PenTests against it
and see. Rapid7 or CoreImpact or Metasploit or any number of system
Vulnerability scanners. If something pops as a finding then address it
and move on. But the certification for eal4 doesn't mean anything
unless you know how to secure the device... That's the bottom line.
Kawika
"Regret for the things we did can be tempered by time; it is regret for
the things we did not do that is inconsolable." -Sydney J. Harris
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of castellan2004-fd@yahoo.com
Sent: Wednesday, November 01, 2006 5:12 AM
To: focus-linux@securityfocus.com
Subject: Vulnerability Assessment of a EAL 4 system
I am looking at a Linux server which has been accredited as a EAL4
system by IBM. During the assessment, I was looking for standard Linux
protections like iptables, ssh etc. On this server, there is no
iptables.
Regardless, I would like to know how to evaluate a EAL
4 system. What do you need to look for in the EAL 4 system in
production that could become vulnerable?
Thank you in advance for any help.
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of castellan2004-fd@yahoo.com
Sent: Wednesday, November 01, 2006 5:12 AM
To: focus-linux@securityfocus.com
Subject: Vulnerability Assessment of a EAL 4 system
I am looking at a Linux server which has been accredited as a EAL4
system by IBM. During the assessment, I was looking for standard Linux
protections like iptables, ssh etc. On this server, there is no
iptables.
Regardless, I would like to know how to evaluate a EAL
4 system. What do you need to look for in the EAL 4 system in
production that could become vulnerable?
Thank you in advance for any help.
