Polski Login Register

Security

Ownership and Control
Redundancy and Failure recovery
  1. Trainers and users have the option to replicate the entire desktop in real time using the 'remote replica' feature.
  2. During experimental sessions, automatic snapshots can be enabled. Should a crash occur, the system can revert to the last stable version.
  3. Servers are hosted in redundant data centers. If one facility experiences a failure, another data center located at low latency distances becomes available to ensure continuity.
  4. The DaDesktop infrastructure leverages a global network of data centers, all governed by comprehensive physical and IT security policies.
  5. DaDesktop utilizes QEMU/KVM for the creation and execution of virtual machines; both are integral components of the Linux operating system. Since QEMU and KVM are built into the Linux OS, security updates can be deployed rapidly and easily, eliminating dependence on third parties. QEMU/KVM boasts an exceptional record in both security and performance, often outperforming commercial alternatives.
At NobleProg, a zero-trust policy is implemented
  1. Access to NobleProg and DaDesktop systems is strictly limited to NP Tech staff whose IP addresses are pre-registered. IP table firewall rules are employed to restrict access to SSH and other ports.
  2. Each system is secured with Two-Factor Authentication and passwords. Consequently, an attacker possessing only a password will be denied access, as their IP address will not be whitelisted, and they will lack the required One-Time Password.
  3. In a DaDesktop course environment, each desktop’s network is isolated from other desktops and public access.
  4. All NobleProg staff members use MFA to log in to NobleProg or DaDesktop systems. Access privileges are revoked immediately upon an employee’s departure to safeguard against unauthorized access.
Linux Hardening
  1. The DaDesktop server (node) system is optimized by installing only essential packages on a custom, stripped-down version of Ubuntu that we build and operate. This approach minimizes complexity and overhead, resulting in fewer security vulnerabilities due to a reduced number of running services. The installed base typically occupies only 250MB on each DaDesktop server node.
  2. Access to the 'root' account is disabled via SSH.
  3. The DaDesktop infrastructure is based on the latest stable version of Ubuntu Linux, with automatic upgrades and patching to mitigate the risk of zero-day vulnerabilities.
  4. Servers are continuously monitored for known vulnerabilities.
  5. Unused packages and files are removed to maintain a clean environment.
  6. NobleProg retains access to all source code used in the project. If a vulnerability is discovered without an available patch, our security team can implement immediate fixes.
  7. Systems are updated automatically (via unattended-upgrades).
  8. All connections from our servers to the dark web are monitored and can be automatically blocked.
Monitoring
  1. NobleProg monitors all its servers, including DaDesktop nodes, generating alerts for any issues requiring attention. These alerts are tracked, resolved, and regularly reviewed to ensure thorough remediation and prevent recurrence.
  2. We monitor CPU, memory, and network activity on all DaDesktop servers and trainer/participant machines. Additionally, DaDesktop nodes and the underlying system are checked for CVEs, which trigger flags in the monitoring system. While security updates are typically applied automatically, exceptions are manually patched or mitigated as necessary.
  3. Automatic recordings are captured from Fresh Start machines during courses to assist Trainers in checking for issues. Recordings of the Trainer machine and Training Room can be optionally enabled, with full control and the ability to disable them via the UI if not required.
  4. DaDesktop Operating System Templates are updated every couple of weeks to include the latest security patches.