DaDesktop is developed by NobleProg Tech and managed exclusively in-house. Any issues are resolved by our dedicated team of Security Ops, Developers, and DevOps specialists. Access to the underlying DaDesktop system is restricted to NP Tech staff only.
NobleProg holds the rights to access, utilise, and modify all source code.
Redundancy and Failure Recovery
Trainers and users have the option to replicate the entire desktop in real time using the 'remote replica' feature.
When experimenting, automatic snapshots of the desktop can be enabled. Should a crash occur, the system is capable of restoring the last functioning version.
Servers are hosted in redundant data centres. In the event of a data centre failure, an alternative data centre is available with low latency proximity.
The DaDesktop infrastructure utilises multiple data centres located globally, supported by comprehensive physical and IT security policies.
DaDesktop employs QEMU/KVM to create and run virtual machines; both QEMU/KVM are integral components of the Linux operating system. As QEMU and KVM are built-in parts of the Linux OS, deploying security updates is both straightforward and rapid, eliminating reliance on third-party concerns. QEMU/KVM boasts an excellent security and performance record, outperforming many commercial solutions.
At NobleProg, a zero-trust policy is implemented
Access to NobleProg and DaDesktop systems is restricted to NP Tech staff users with pre-registered IP addresses. IP tables firewall rules are enforced to block access for SSH and other ports.
Each system is secured via Two-Factor Authentication and passwords. An attacker who has obtained only the password will be unable to access the system, as their IP address would not be whitelisted and they would lack the One-Time Password.
In a DaDesktop course environment, each desktop network is isolated from other desktops and public access.
NobleProg staff utilise a Multi-Factor Authentication (MFA) system to log in to NobleProg or DaDesktop systems. Access is revoked immediately upon a staff member’s departure to protect systems from unauthorised access.
Linux Hardening
DaDesktop server (node) systems are minimised by installing only essential packages on a custom, stripped-down version of Ubuntu that we build and operate, reducing added complexity and overhead. This approach minimises security vulnerabilities by limiting the number of packages and services running at any given time. The installed base typically amounts to only 250MB for each DaDesktop server node.
Access to the 'root' account is disabled via SSH.
The DaDesktop infrastructure is based on the latest stable version of Ubuntu Linux, with automatic upgrades and patching applied, thereby mitigating the risk of zero-day vulnerabilities.
Servers are continuously monitored for known vulnerabilities.
Unused packages and files are removed.
NobleProg retains access to all source code used in the project. Should a vulnerability be discovered without an available patch, NobleProg’s security team can implement a patch immediately.
Systems are updated automatically via unattended-upgrades.
All connections from our servers to dark-web sites are monitored and can be automatically blocked.
Monitoring
NobleProg monitors all its servers, including DaDesktop servers, generating alerts for any issues requiring attention. These alerts are followed up and resolved. Regular reviews of alerts or issues are conducted to ensure each matter is fully addressed, preventing recurrence.
We monitor all DaDesktop servers and trainer/participant machines for CPU, memory, and network activity, among other metrics. Additionally, all DaDesktop nodes and the underlying system are monitored for any CVEs, which trigger flags in the monitoring system for review. While security updates are generally applied automatically, any exceptions identified are patched manually, and/or other mitigating measures are implemented.
Recordings are automatically captured from the Fresh Start machines on courses, allowing Trainers to check for any issues during course preparation. Recordings of the Trainer machine and Training Room during a course can be made optionally. This feature is fully controllable via the UI and can be disabled if not required.
DaDesktop Operating System Templates are updated approximately every two weeks, incorporating the latest security updates.