Security

DaDesktop is written by NobleProg Tech and maintained and developed entirely in-house – any issues are handled by our own specialist team of Security Ops, Devs and DevOps staff. Only NP Tech staff have access to the underlying DaDesktop system.
NobleProg has access and rights to use and modify all source code.

Trainers and users can opt to replicate the entire desktop in real time via the 'remote replica' option.
When experimenting, automatic snapshots of a desktop can be turned on. Should a crash occur, the system can restore the last working version.
Servers are hosted in redundant data centres; if one data centre fails, another is available with low latency.
The DaDesktop infrastructure spans multiple data centres worldwide, with robust physical and IT security policies in effect.
DaDesktop employs QEMU/KVM to create and run virtual machines; both are integral to the Linux operating system. Because QEMU and KVM are built-in components of Linux, security updates can be deployed both quickly and easily, with no reliance on third parties. QEMU/KVM boasts an outstanding security and performance record, surpassing that of commercial alternatives.

Only NP Tech staff with pre-registered IP addresses are permitted access to NobleProg and DaDesktop systems. IP tables firewall rules block access to SSH and other ports.
Each system is protected by two-factor authentication and a password, meaning that even if an attacker obtains the password, they still cannot access the system because their IP isn't whitelisted and they lack the one-time password.
During a DaDesktop course, each desktop network is isolated from other desktops and from public access.
All NobleProg staff use an MFA system to log into NobleProg or DaDesktop systems. Access is revoked immediately when a staff member leaves, safeguarding our systems from unauthorised access.

DaDesktop server (node) systems are kept minimal by installing only essential packages: a custom, stripped-down version of Ubuntu that we build and run to cut down on unnecessary complexity and overhead. This reduces the number of security vulnerabilities, since fewer packages are required and therefore fewer services are active at any given time. The typical installed footprint is just 250 MB per DaDesktop server node.
Root account access is disabled in SSH.
The DaDesktop infrastructure runs on the latest stable version of Ubuntu Linux, which is automatically upgraded and patched, thereby minimising the risk of zero-day vulnerabilities.
Servers are monitored for known vulnerabilities.
Unused packages and files are removed.
NobleProg has access to all source code used in the project. If a vulnerability is discovered and no patch is available, NobleProg's security team can patch it immediately.
Systems are automatically updated (unattended-upgrades).
All connections from our servers to the dark web are monitored and can be automatically blocked.

NobleProg monitors all its servers, including DaDesktop servers, generating alerts for any issues that require attention. These alerts are followed up and resolved. Regular reviews of alerts and issues are conducted to ensure each is thoroughly addressed, preventing recurrence.
We monitor all DaDesktop servers and trainer/participant machines for CPU, memory, and network activity. In addition, all DaDesktop nodes and the underlying system are checked for any CVEs that trigger alerts on the monitoring system. Typically, security updates are applied automatically, but if any exceptions are detected, they are patched manually, or other mitigating actions are taken.
Fresh Start machines on courses are automatically recorded, allowing any issues with a Trainer's course setup to be reviewed. Optionally, recordings can be made of the Trainer machine and Training Room during a course. This feature is fully controllable via the UI and can be turned off if not needed.
DaDesktop operating system templates are generally updated every couple of weeks, incorporating the latest security patches.