Português Login Register

Security

Ownership and Control
Redundancy and Failure recovery
  1. Trainers and users can opt to replicate the entire desktop in real time using the 'remote replica' feature.
  2. When experimenting, users can enable automatic snapshots of the desktop. In the event of a crash, the system can restore the last working version.
  3. Servers are hosted in redundant datacentres; should one datacentre experience a failure, another is available with low latency.
  4. The DaDesktop infrastructure utilizes a global network of datacentres, all of which adhere to comprehensive physical and IT security policies.
  5. DaDesktop leverages QEMU/KVM to create and run virtual machines. Since both QEMU and KVM are integral parts of the Linux operating system, security updates can be deployed quickly and easily without reliance on third parties. QEMU/KVM boasts an excellent track record for both security and performance, surpassing many commercial solutions.
At NobleProg, a zero-trust policy is implemented
  1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff members with pre-registered IP addresses. Firewall rules via IP tables are applied to secure SSH and other ports.
  2. Every system is secured with Two-Factor Authentication and password protection. Consequently, an attacker who obtains only the password cannot gain access, as their IP would not be whitelisted and they would lack the One-Time Password.
  3. Within a DaDesktop course, each desktop network is isolated from other desktops and public access.
  4. All NobleProg staff utilize a Multi-Factor Authentication (MFA) system to log in to NobleProg or DaDesktop systems. Access is immediately revoked if an employee leaves, safeguarding against unauthorised access.
Linux Hardening
  1. The DaDesktop server (node) system is minimised by installing only necessary packages via a custom, stripped-down version of Ubuntu developed and operated by NobleProg. This reduces complexity and overhead, resulting in fewer security vulnerabilities due to fewer running packages and services. The installed base for each DaDesktop server node is typically only 250MB.
  2. Access to the 'root' account is disabled via SSH.
  3. The DaDesktop infrastructure is built on the newest stable version of Ubuntu Linux, which is automatically upgraded and patched to mitigate the risk of zero-day vulnerabilities.
  4. Servers are continuously monitored for known vulnerabilities.
  5. Unused packages and files are removed to reduce the attack surface.
  6. NobleProg has access to all source code used in the project. Should a vulnerability be discovered without an available patch, the NobleProg security team can implement a fix immediately.
  7. Systems are automatically updated using unattended-upgrades.
  8. All connections from our servers to dark-web sites are monitored and can be automatically blocked.
Monitoring
  1. NobleProg monitors all its servers, including DaDesktop servers, and generates alerts for any issues requiring attention. These alerts are followed up and resolved. Regular reviews of alerts and issues are conducted to ensure comprehensive resolution and prevent recurrence.
  2. All DaDesktop servers and trainer/participant machines are monitored for CPU, memory, and network activity, among other metrics. Additionally, all DaDesktop nodes and the underlying system are scanned for CVEs, which trigger flags in the monitoring system for inspection. While security updates are typically applied automatically, any exceptions identified here are patched manually or addressed with other mitigating measures.
  3. Automatic recordings of Fresh Start machines are taken during courses, allowing trainers to check for issues during course preparation. Recordings of the Trainer machine and Training Room during a course can also be optionally enabled. This feature is fully controllable via the UI and can be disabled if not required.
  4. DaDesktop Operating System Templates are updated every couple of weeks to include the latest security updates.