Login Register

Security

Ownership and Control
Redundancy and Failure recovery
  1. Trainers and users have the option to replicate their entire desktop in real time using the 'remote replica' feature.
  2. During experimentation, automatic snapshots of the desktop can be enabled. Should a crash occur, the system is capable of restoring the last working version.
  3. Servers are hosted in redundant datacentres. In the event of a failure at one location, another datacentre with low latency distance remains available.
  4. The DaDesktop infrastructure leverages a network of datacentres located globally, supported by comprehensive physical and IT security policies.
  5. DaDesktop employs QEMU/KVM to create and run virtual machines. As both are native components of the Linux operating system, security updates can be deployed quickly and efficiently without reliance on third-party software. QEMU/KVM boasts an excellent record for both security and performance, often outperforming commercial alternatives.
At NobleProg, a zero-trust policy is implemented
  1. Access to the NobleProg and DaDesktop systems is restricted to NP Tech staff whose IP addresses are pre-registered. IP tables firewall rules are enforced to block access for SSH and other ports.
  2. Each system is protected by Two Factor Authentication and password credentials. Consequently, an attacker who obtains only the password cannot gain access, as their IP address would not be whitelisted and they would lack the One Time Password.
  3. In a DaDesktop course environment, each desktop network is isolated from other desktops and public access.
  4. All NobleProg staff use an MFA system to log in to NobleProg or DaDesktop systems. Access is withdrawn immediately if a member of staff leaves, thereby protecting our systems from unauthorised access.
Linux Hardening
  1. The DaDesktop server (node) system is minimised by installing only necessary packages on a custom, stripped-down version of Ubuntu that we build and operate. This approach reduces added complexity and overhead, resulting in fewer potential security holes and fewer active services. The installed base for each DaDesktop server node is typically only 250MB.
  2. Access to the 'root' account via SSH is disabled.
  3. The DaDesktop infrastructure is built on the latest stable version of Ubuntu Linux, which is automatically upgraded and patched, thereby reducing the risk of zero-day vulnerabilities.
  4. Servers are continuously monitored for known vulnerabilities.
  5. Unused packages and files are removed.
  6. NobleProg has access to all source code used in the project. Should a vulnerability be discovered where a patch is not yet available, the NobleProg security team can apply a fix immediately.
  7. Systems are updated automatically via unattended-upgrades.
  8. All connections from our servers to the dark-web are monitored and can be automatically blocked.
Monitoring
  1. NobleProg monitors all its servers, including DaDesktop instances, generating alerts for any issues requiring attention. These alerts are followed up and resolved. Regular reviews are conducted to ensure each issue is fully addressed, preventing recurrence.
  2. We monitor all DaDesktop servers and trainer/participant machines for CPU, memory, and network activity. Additionally, DaDesktop nodes and the underlying system are checked for any CVEs, which trigger flags in the monitoring system. While security updates are typically applied automatically, any exceptions identified here are patched manually or addressed through other mitigating measures.
  3. Recordings are automatically captured of Fresh Start machines on courses, allowing Trainers to verify the setup before delivery. Optionally, recordings of the Trainer machine and Training Room can be made during a course. This feature is fully controllable via the UI and can be disabled if not required.
  4. DaDesktop Operating System Templates are updated every few weeks to incorporate the latest security patches.