Security

Ownership and Control

• DaDesktop is developed entirely in-house by NobleProg Tech, with ongoing maintenance and evolution managed by our specialized teams of Security Ops, Developers, and DevOps staff. This ensures that any issues are handled internally by our own experts, as only NP Tech staff possess access to the underlying DaDesktop system.
• NobleProg retains full rights to access, utilize, and modify all source code associated with the platform.

Redundancy and Failure Recovery

1. Trainers and users have the option to replicate their entire desktop in real time using the 'remote replica' feature.
2. During experimental sessions, automatic snapshots of the desktop can be enabled. In the event of a crash, the system is capable of restoring the last stable version.
3. Our servers are hosted in redundant data centers; if one data center experiences a failure, another is available at a low-latency distance to ensure continuity.
4. The DaDesktop infrastructure leverages a global network of data centers, all operating under comprehensive physical and IT security policies.
5. DaDesktop utilizes QEMU/KVM to create and run virtual machines, both of which are integral components of the Linux operating system. Since QEMU and KVM are built into the Linux OS, deploying security updates is both straightforward and rapid, eliminating concerns about third-party dependencies. QEMU/KVM boasts an excellent track record for both security and performance, often outperforming commercial alternatives.

At NobleProg, a Zero-Trust Policy is Implemented

1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff users with pre-registered IP addresses. IP tables firewall rules are strictly enforced to secure SSH and other ports.
2. Every system is protected by Two-Factor Authentication and passwords. Consequently, an attacker who obtains a password alone cannot gain access, as their IP would not be whitelisted and they would lack the required One-Time Password.
3. In DaDesktop courses, each desktop network is isolated from other desktops and from public access.
4. All NobleProg staff employees use a Multi-Factor Authentication (MFA) system to log in to NobleProg or DaDesktop systems. Access rights are revoked immediately when an employee leaves, protecting our systems from unauthorized access.

Linux Hardening

1. DaDesktop server nodes are optimized by installing only the necessary packages on a custom, stripped-down version of Ubuntu that we develop and operate. This approach reduces added complexity and overhead, resulting in fewer security holes due to a reduced number of running packages and services. The installed base is typically only 250MB for each DaDesktop server node.
2. Direct access to the 'root' account via SSH is disabled.
3. The DaDesktop infrastructure is based on the latest stable version of Ubuntu Linux, which is automatically upgraded and patched. This significantly reduces the risk of zero-day vulnerabilities.
4. Servers are continuously monitored for known vulnerabilities.
5. Unused packages and files are removed to minimize the attack surface.
6. NobleProg has access to all source code used in the project. If a vulnerability is discovered for which a patch is not yet available, our security team can implement a fix immediately.
7. Systems receive automatic updates via unattended-upgrades.
8. All connections from our servers to the dark web are monitored and can be automatically blocked.

Monitoring

1. NobleProg monitors all its servers, including DaDesktop instances, generating alerts for any issues that require attention. These alerts are systematically followed up and resolved. Regular reviews of alerts and issues are conducted to ensure each problem is fully addressed, preventing recurrence.
2. We monitor all DaDesktop servers and trainer/participant machines for CPU, memory, and network activity. Additionally, all DaDesktop nodes and the underlying system are checked for any CVEs, which trigger flags in the monitoring system for review. While security updates are generally applied automatically, any exceptions identified here are patched manually, and other mitigating measures can be implemented if necessary.
3. Automatic recordings are captured of the Fresh Start machines during courses, allowing trainers to check for any issues during course preparation. Recordings of the Trainer machine and Training Room during a course can optionally be made. This feature is fully controllable via the UI and can be disabled if not required.
4. DaDesktop Operating System Templates are typically updated every couple of weeks, incorporating the latest security patches.