Security

Ownership and Control

• DaDesktop is developed and fully maintained in-house by NobleProg Tech. Any arising issues are managed by our dedicated specialist team comprising Security Ops, Developers, and DevOps staff. Access to the underlying DaDesktop system is strictly limited to NP Tech personnel.
• NobleProg retains full access and rights to utilize and modify all source code associated with the platform.

Redundancy and Failure Recovery

1. Instructors and users have the option to replicate the entire desktop environment in real time using the 'remote replica' feature.
2. For experimental purposes, automatic snapshots can be enabled. In the event of a crash, the system can restore the last known working version.
3. Servers are hosted in redundant data centres. Should a data centre fail, an alternative facility with low-latency connectivity remains available to ensure continuity.
4. The DaDesktop infrastructure leverages data centres located globally, all of which adhere to comprehensive physical and IT security policies.
5. DaDesktop utilizes QEMU/KVM to create and run virtual machines. As both QEMU and KVM are integrated components of the Linux operating system, security updates are deployed rapidly and easily without third-party dependencies. QEMU/KVM boasts an excellent record for both security and performance, often outperforming commercial alternatives.

At NobleProg, a zero-trust policy is implemented

1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff users with pre-registered IP addresses. IP table firewall rules are enforced to secure SSH and other port access.
2. Every system is protected by Two-Factor Authentication alongside password requirements. Consequently, an attacker who possesses only the password will be unable to gain access, as their IP address will not be whitelisted and they will lack the One-Time Password.
3. During DaDesktop courses, each desktop network is isolated from other desktops and public access to ensure a secure environment.
4. All NobleProg staff members are required to use a Multi-Factor Authentication (MFA) system to log in to NobleProg or DaDesktop systems. Access rights are revoked immediately upon an employee's departure to prevent unauthorised access.

Linux Hardening

1. DaDesktop server systems are minimised by installing only essential packages. We operate a custom, stripped-down version of Ubuntu, reducing added complexity and overhead. This approach results in fewer security vulnerabilities, as fewer packages and services are active at any given time. The installed base for each DaDesktop server node is typically only 250MB.
2. Access to the 'root' account via SSH is disabled.
3. The DaDesktop infrastructure employs the latest stable version of Ubuntu Linux as its base. The system is automatically upgraded and patched, thereby mitigating the risk of zero-day vulnerabilities.
4. Servers are continuously monitored for known vulnerabilities.
5. Unused packages and files are regularly removed to maintain system integrity.
6. NobleProg has access to all source code used in the project. In the event that a vulnerability is discovered but no official patch is available, the NobleProg security team can implement a patch immediately.
7. Systems undergo automatic updates via unattended-upgrades.
8. All connections from our servers to the dark web are monitored and can be automatically blocked.

Monitoring

1. NobleProg monitors all its servers, including DaDesktop servers, generating alerts for any issues requiring attention. These alerts are systematically followed up and resolved. Regular reviews of alerts and issues are conducted to ensure comprehensive resolution and prevent recurrence.
2. We monitor all DaDesktop servers and trainer or participant machines for CPU, memory, and network activity. Additionally, all DaDesktop nodes and the underlying system are checked for any CVEs, which flag items in the monitoring system for review. While security updates are generally applied automatically, any exceptions identified are patched manually or addressed through other mitigating measures.
3. Recordings are automatically captured from Fresh Start machines during courses, assisting Trainers in checking for issues during course preparation. Recordings of Trainer machines and Training Rooms can also be optionally made during sessions. This feature is fully controllable via the UI and can be disabled if not required.
4. DaDesktop Operating System Templates are typically updated every few weeks to incorporate the latest security updates.