Security

Ownership and Control

• DaDesktop is developed and maintained entirely in-house by NobleProg Tech. Our dedicated internal team of Security Operations, Developers, and DevOps specialists handles all issues, ensuring that only NP Tech staff have access to the core DaDesktop system.
• NobleProg retains full rights and access to utilize and modify all source code associated with the platform.

Redundancy and Failure recovery

1. Instructors and participants can opt to replicate their entire desktop environment in real-time using the 'remote replica' feature.
2. During experimentation, users may enable automatic snapshots. This ensures that in the event of a system crash, the last stable working version can be quickly restored.
3. Our servers are hosted across redundant data centres, ensuring that if one facility experiences a failure, another is readily available with low-latency connectivity to maintain service continuity.
4. The DaDesktop infrastructure leverages a global network of data centres, all governed by robust physical and IT security protocols.
5. By utilizing QEMU/KVM to create and execute virtual machines, DaDesktop benefits from built-in Linux OS components. This integration streamlines the deployment of security updates, eliminating third-party dependencies. QEMU/KVM offers a superior security and performance profile compared to many commercial alternatives.

At NobleProg, a zero-trust policy is implemented

1. Access to NobleProg and DaDesktop systems is strictly restricted to authorized NP Tech staff with pre-registered IP addresses. We enforce IP-based firewall rules to block unauthorized SSH and other port access.
2. Every system is secured with Two-Factor Authentication (2FA) alongside standard passwords. This multi-layered approach ensures that even if a password is compromised, access remains denied without a valid One-Time Password and a whitelisted IP address.
3. Within a DaDesktop course environment, each desktop network is logically isolated from other instances and external public networks to prevent cross-contamination.
4. All NobleProg employees are required to use Multi-Factor Authentication (MFA) for system login. Access rights are revoked immediately upon staff departure to safeguard against unauthorized access.

Linux Hardening

1. DaDesktop server nodes run on a minimized, custom-stripped version of Ubuntu. By installing only essential packages, we reduce complexity and overhead. This streamlined approach limits the attack surface, as fewer running services mean fewer potential vulnerabilities. Typically, the base installation on each node is as small as 250MB.
2. Direct access to the 'root' account via SSH is disabled to enhance security.
3. Our infrastructure is built on the latest stable version of Ubuntu Linux, with automatic upgrades and patching enabled to mitigate the risk of zero-day vulnerabilities.
4. Continuous monitoring is performed to detect and address known vulnerabilities on all servers.
5. All unused packages and files are systematically removed to maintain a clean and secure environment.
6. As NobleProg owns the entire source code, our security team can immediately implement patches for any discovered vulnerabilities, even if official updates are not yet available.
7. Automated updates (unattended-upgrades) are applied regularly to keep systems secure.
8. All server connections to dark-web sites are monitored and automatically blocked to prevent malicious communications.

Monitoring

1. NobleProg actively monitors all servers, including those powering DaDesktop. Any detected issues generate immediate alerts for our team to address. We conduct regular reviews of these alerts and resolutions to ensure root causes are eliminated, preventing recurrence.
2. We continuously monitor DaDesktop servers and participant machines for CPU, memory, and network activity. Additionally, our nodes are scanned for CVEs; any flags raised in the monitoring system trigger immediate checks. While security updates are generally applied automatically, any exceptions identified are manually patched, or alternative mitigating measures are implemented.
3. Automatic recordings are captured from Fresh Start machines to assist trainers in verifying course preparation. Optional recordings of the trainer’s machine and the training room can be enabled during sessions. This feature is fully controllable via the UI and can be disabled if not required.
4. DaDesktop Operating System Templates are refreshed bi-weekly to incorporate the latest security patches and updates.