Security

Ownership and Control

• DaDesktop is developed entirely in-house by NobleProg Tech. The platform is maintained and evolved by our dedicated internal team, comprising Security Ops, Developers, and DevOps professionals, ensuring all issues are handled by specialized staff. Access to the core DaDesktop system is strictly limited to NP Tech personnel.
• NobleProg holds full rights and access to utilize and modify all source code.

Redundancy and Failure recovery

1. Trainers and users have the option to replicate the entire desktop in real-time using the 'remote replica' feature.
2. When conducting experiments, automatic snapshots of the desktop can be enabled. This allows the system to restore the last working version in the event of a crash.
3. Servers are hosted in redundant datacentres. Should a datacentre fail, alternative datacentres are available with low-latency connections to ensure continuity.
4. The DaDesktop infrastructure leverages a network of datacenters located globally, all adhering to comprehensive physical and IT security standards.
5. DaDesktop utilizes QEMU/KVM to create and run virtual machines, both of which are integral components of the Linux operating system. Because QEMU and KVM are built into the Linux OS, deploying security updates is both swift and straightforward, eliminating reliance on third-party vulnerabilities. QEMU/KVM boasts an outstanding record for security and performance, often outperforming commercial alternatives.

At NobleProg, a zero-trust policy is implemented

1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff users with pre-registered IP addresses. IP tables firewall rules are employed to secure access to SSH and other critical ports.
2. Each system is safeguarded by Two Factor Authentication and passwords. Consequently, even if an attacker obtains a password, they cannot gain access without a whitelisted IP address and a valid One Time Password.
3. In DaDesktop courses, each desktop network is isolated from other desktops and public access to enhance security.
4. All NobleProg staff members use a MFA system to log in to NobleProg or DaDesktop systems. Access is revoked immediately upon an employee's departure to prevent unauthorized entry.

Linux Hardening

1. The DaDesktop server (node) systems are minimized by installing only essential packages on a custom, streamlined version of Ubuntu that we build and manage. This approach reduces complexity and overhead, resulting in fewer running services and thus fewer potential security holes. The installed base is typically only 250MB per DaDesktop server node.
2. Access to the 'root' account is disabled via ssh.
3. The DaDesktop infrastructure is based on the newest stable version of Ubuntu Linux, with automatic upgrades and patching in place. This significantly reduces the risk associated with zero-day vulnerabilities.
4. Servers are continuously monitored for known vulnerabilities.
5. Unused packages and files are regularly removed to maintain system integrity.
6. NobleProg maintains access to all source code used in the project. In the event that a vulnerability is discovered before an official patch is available, the NobleProg security team can implement an immediate fix.
7. Systems are kept current through automated updates (unattended-upgrades).
8. All connections from our servers to the dark-web are monitored and can be automatically blocked if necessary.

Monitoring

1. NobleProg monitors all its servers, including DaDesktop nodes, generating alerts for any issues requiring attention. These alerts are promptly followed up and resolved. Regular reviews of alerts and issues are conducted to ensure that root causes are addressed, preventing recurrence.
2. All DaDesktop servers and trainer/participant machines are monitored for CPU, memory, and network activity. Additionally, DaDesktop nodes and the underlying system are checked for any CVEs, which trigger flags in the monitoring system for investigation. While security updates are typically applied automatically, any exceptions identified are patched manually, or other mitigating measures are implemented as needed.
3. Recordings are automatically captured from Fresh Start machines during courses, aiding trainers in checking for issues during course preparation. Recordings of the Trainer machine and Training Room can be optionally enabled during a course. This feature is fully controllable via the UI and can be disabled if not required.
4. DaDesktop Operating System Templates are typically updated every few weeks to include the latest security patches.