Focus on Linux
Vulnerability Assessment of a EAL 4 system Nov 01 2006 10:12AM
castellan2004-fd yahoo com (3 replies)
Re: Vulnerability Assessment of a EAL 4 system Nov 02 2006 04:00PM
shashi (shashi boddula oracle com)
Re: Vulnerability Assessment of a EAL 4 system Nov 01 2006 09:32PM
terry white (twhite aniota com)
RE: Vulnerability Assessment of a EAL 4 system Nov 01 2006 05:34PM
Stong, Ian (Ian Stong ctr disa mil) (1 replies)
RE: Vulnerability Assessment of a EAL 4 system Nov 02 2006 03:43PM
Takayama Kawika (DTI) (Kawika Takayama state de us)
This is one of the only Linux Distro's in production certified for
EAL4...

"Following in the wake of its previous certifications, Novell's SUSE
Linux Enterprise Server 9 has achieved EAL4 certification on 'an IBM
eServer.' This puts SLES9 in the same league as Windows 2000 for sales
in the government sector and is the first Linux distro to achieve an
EAL4 certification."

Here is more support....
http://en.wikipedia.org/wiki/Evaluation_Assurance_Level

If you have a current EAL level 4 certified system and it is in
production, it means nothing to the extent other than you have a very
expensive piece of hardware. Can you secure it? If you are looking for
this answer then my suggestion is to run a series of PenTests against it
and see. Rapid7 or CoreImpact or Metasploit or any number of system
Vulnerability scanners. If something pops as a finding then address it
and move on. But the certification for eal4 doesn't mean anything
unless you know how to secure the device... That's the bottom line.

Kawika

"Regret for the things we did can be tempered by time; it is regret for
the things we did not do that is inconsolable." -Sydney J. Harris

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of castellan2004-fd (at) yahoo (dot) com [email concealed]
Sent: Wednesday, November 01, 2006 5:12 AM
To: focus-linux (at) securityfocus (dot) com [email concealed]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4
system by IBM. During the assessment, I was looking for standard Linux
protections like iptables, ssh etc. On this server, there is no
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system. What do you need to look for in the EAL 4 system in
production that could become vulnerable?

Thank you in advance for any help.
-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]]
On Behalf Of castellan2004-fd (at) yahoo (dot) com [email concealed]
Sent: Wednesday, November 01, 2006 5:12 AM
To: focus-linux (at) securityfocus (dot) com [email concealed]
Subject: Vulnerability Assessment of a EAL 4 system

I am looking at a Linux server which has been accredited as a EAL4
system by IBM. During the assessment, I was looking for standard Linux
protections like iptables, ssh etc. On this server, there is no
iptables.

Regardless, I would like to know how to evaluate a EAL
4 system. What do you need to look for in the EAL 4 system in
production that could become vulnerable?

Thank you in advance for any help.

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus