Higher levels of security (EAL6 and 7) are only achieved for isolated systems

From hardening perspective, hardware is always trustable

OS hardening of non-critical systems is never needed

From a security perspective OS hardening is not as important as application hardening

100% secure system is not achievable

Hardening is mostly quantitative whereas security is not

Formal methods are needed for the highest level of security (EAL7)

Security of a system always decreases along time