Security

Ownership and Control

• DaDesktop is developed by NobleProg Tech, with all maintenance and development handled entirely in-house. Any issues are managed by our dedicated team of Security Ops, Developers, and DevOps specialists. Exclusive access to the underlying DaDesktop system is restricted to NP Tech staff.
• NobleProg retains full access and rights to utilise and modify all source code.

Redundancy and Failure Recovery

1. Trainers and users have the option to replicate their entire desktop in real time using the 'remote replica' feature.
2. During experimental sessions, automatic snapshots of the desktop can be enabled. In the event of a crash, the system is capable of restoring the last stable version.
3. Servers are hosted in redundant data centres to ensure that if one data centre experiences a failure, another is available with low-latency connectivity.
4. The DaDesktop infrastructure leverages a network of data centres located globally, all underpinned by comprehensive physical and IT security policies.
5. DaDesktop utilises QEMU/KVM for the creation and execution of virtual machines. As both QEMU and KVM are integral components of the Linux operating system, security updates can be deployed rapidly and efficiently without reliance on third-party dependencies. QEMU/KVM boasts an exceptional record for both security and performance, outperforming many commercial solutions.

NobleProg implements a zero-trust policy

1. Access to NobleProg and DaDesktop systems is strictly limited to NP Tech staff users with pre-registered IP addresses. IP table firewall rules are enforced to secure SSH and other critical ports.
2. Every system is secured via Two-Factor Authentication and password protection. Consequently, even an attacker who obtains a password alone cannot gain access, as their IP address would not be whitelisted, and they would lack the required One-Time Password.
3. During a DaDesktop course, each desktop's network is isolated from other desktops and from public internet access.
4. All NobleProg staff are required to use MFA for logging into NobleProg or DaDesktop systems. Access credentials are immediately revoked upon an employee's departure to safeguard against unauthorised access.

Linux Hardening

1. The DaDesktop server (node) system is minimised by installing only essential packages onto a custom, stripped-down version of Ubuntu that we build and operate. This approach reduces complexity and overhead, resulting in fewer security vulnerabilities since there are fewer packages and services running at any given time. Typically, the installed base for each DaDesktop server node is only 250MB.
2. Access to the 'root' account is disabled via SSH.
3. The DaDesktop infrastructure is built on the latest stable version of Ubuntu Linux, with automatic upgrades and patching to mitigate the risk of zero-day vulnerabilities.
4. Servers are continuously monitored for known vulnerabilities.
5. Unused packages and files are routinely removed to maintain a lean environment.
6. NobleProg has access to all source code within the project. In the event that a vulnerability is discovered without an available patch, the NobleProg security team can implement a fix immediately.
7. Systems undergo automatic updates via unattended-upgrades.
8. All connections from our servers to the dark web are monitored and can be automatically blocked.

Monitoring

1. NobleProg monitors all servers, including DaDesktop instances, generating alerts for any issues requiring attention. These alerts are diligently followed up and resolved. Regular reviews are conducted to ensure issues are fully addressed, preventing recurrence.
2. We monitor all DaDesktop servers, as well as trainer and participant machines, for CPU, memory, and network activity. Additionally, all DaDesktop nodes and the underlying system are checked for CVEs, which trigger flags in the monitoring system for review. While security updates are typically applied automatically, any exceptions identified are manually patched, and other mitigating measures may be implemented if necessary.
3. Automatic recordings are captured on Fresh Start machines during courses, allowing Trainers to verify course preparation. Optionally, recordings of the Trainer’s machine and the Training Room can be enabled during a course. This feature is fully controllable via the UI and can be disabled if not required.
4. DaDesktop Operating System Templates are updated approximately every couple of weeks to incorporate the latest security patches.