EAL 4 security level + eTrust Access Control

[BLETARD Philippe]

Hello! I've a small question regarding the EAL4 security level. I know that HP-UX is certified EAL4 but do I have to configure something to reach this level (RBAC or ???) ? I know there's some tools like eTrust Access Control to achieve this but is it really needed ???

[Florian Heigl (new acc)]

Hi,

in http://h20338.www2.hp.com/hpux11i/downloads/HP-UX-11i-common-cri.pdf it would appear that the information You need (test protocols and configuration changes) will be found at the commoncriteria.org website, but it seems to be unavailable.

please check out the following link at a later time:
http://www.commoncriteria.org/ccc/epl/productType/epldetail.jsp?id=145

I'm quite sure using RBAC won't be enough, I doubt You get to certification levels without using the TCB (by converting to a trusted system) and some audits set up.

Good luck :)

[Florian Heigl (new acc)]

Found it:

This has the list of requirements, etc.:

http://www.commoncriteriaportal.org/public/files/CPList/HP-UX_ST-issue_4-0.pdf

[BLETARD Philippe]

Hi Florian!Thanks for your quick answer!I will browse these documents to have an idea of what I have to do... I was also searching for a document/informations with the steps to follow to reach this EAL level.
BR,
Phil

[Florian Heigl (new acc)]

You might find it hard to implement the following part in standard network:

b) The product executes on a single HP 9000 Server, which may be connected to
other HP 9000 Servers via a local Ethernet network, each executing the same
version of the product. No other processors may be connected to the product,
either directly by hardwire connection (e.g. to implement a Cluster of HP 9000
systems) or indirectly by, for example, a Wide Area Network or telephone cable
to provide remote computer or network services

*smirks*