✉️contact@dadesktop.co.nz

Security

Ownership and Control
Redundancy and Failure Recovery
  1. Trainers and participants can replicate an entire desktop in real time using the 'remote replica' option.
  2. While experimenting, you can enable automatic snapshots. If the system crashes, it can restore the last working version.
  3. Servers are kept in redundant data centres; if one centre fails, another is available with low latency.
  4. DaDesktop infrastructure spans multiple data centres around the globe, including in New Zealand, all backed by stringent physical and IT security policies.
  5. DaDesktop uses QEMU/KVM to create and run virtual machines—both are built into the Linux operating system. Because they're native Linux components, security updates are incredibly quick and easy to roll out, with no third-party dependencies to worry about. QEMU/KVM boasts an excellent security and performance record, outperforming many commercial solutions.
NobleProg enforces a zero-trust policy
  1. Only NP Tech staff with pre-registered IP addresses can access NobleProg and DaDesktop systems. IP tables firewall rules lock down SSH and other ports.
  2. Every system is safeguarded by two-factor authentication and a password. So even if an attacker got hold of the password, they still couldn't get in without a whitelisted IP and a one-time password.
  3. During a DaDesktop course, each desktop network is completely isolated from others and from public access.
  4. All NobleProg employees use multi-factor authentication to log in. Access is revoked immediately when someone leaves, keeping our systems safe from unauthorised entry.
Linux Hardening
  1. DaDesktop server nodes run a stripped-down, customised version of Ubuntu with only the essential packages installed, cutting out unnecessary complexity and overhead. This means fewer security holes because there are fewer services running at any given time—the base install is normally around 250MB per node.
  2. Root account access via SSH is disabled.
  3. The infrastructure runs on the latest stable Ubuntu LTS, automatically patched and upgraded, which dramatically reduces the risk of zero-day vulnerabilities.
  4. Servers are constantly monitored for known vulnerabilities.
  5. Unused packages and files are stripped out.
  6. NobleProg has access to all source code used in the project. If a vulnerability appears and no patch is available yet, our security team can fix it straight away.
  7. Systems are updated automatically (via unattended-upgrades).
  8. All connections from our servers to the dark web are monitored and can be blocked automatically.
Monitoring
  1. NobleProg keeps a close eye on all servers, including DaDesktop infrastructure, and sets up alerts for anything that needs attention. Alerts are followed up and resolved, and we regularly review them to prevent repeat issues.
  2. We monitor CPU, memory, and network activity on all DaDesktop servers and trainer/participant machines. The system also flags any CVEs on nodes or the underlying platform for immediate checking. Most security updates are applied automatically, but if anything unusual comes up, it's patched manually or other mitigation steps are taken.
  3. Recordings are automatically made of Fresh Start machines for courses, helping us inspect any problems when a trainer sets up a course. Optionally, the trainer's machine and the training room can be recorded during a session. This is fully controllable in the UI and can be turned off if not needed.
  4. DaDesktop OS templates are refreshed typically every couple of weeks with the latest security updates.