Português Login Register

Security

Ownership and Control
Redundancy and Failure recovery
  1. Trainers and users have the option to replicate their entire desktop in real time using the 'remote replica' feature.
  2. When conducting experiments, automatic snapshots of the desktop can be activated. In the event of a crash, the system can restore the last working version.
  3. Servers are hosted in redundant data centers; if one data center fails, another is available with low latency proximity.
  4. The DaDesktop infrastructure leverages a network of data centers located globally, all governed by comprehensive physical and IT security policies.
  5. DaDesktop utilizes QEMU/KVM to create and execute virtual machines. Both components are part of the Linux operating system. Since QEMU and KVM are built-in components of the Linux OS, security updates are deployed quickly and easily, with no reliance on third parties. QEMU/KVM boasts an excellent security and performance record, outperforming many commercial solutions.
At NobleProg, a zero-trust policy is implemented
  1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff users with pre-registered IP addresses. IP tables firewall rules are employed to block access for SSH and other ports.
  2. Each system is secured by Two-Factor Authentication and passwords. An attacker who obtains only a password cannot access the system, as their IP address would not be whitelisted and they would lack the One-Time Password.
  3. On DaDesktop courses, each desktop network is isolated from other desktops and public access.
  4. All NobleProg staff members use a MFA system to log in to NobleProg or DaDesktop systems. Access is immediately revoked if a staff member departs, protecting systems from unauthorized access.
Linux Hardening
  1. The DaDesktop server (node) systems are minimized by installing only necessary packages on a custom, stripped-down version of Ubuntu that we build and operate. This approach reduces added complexity and overhead, resulting in fewer security holes as fewer packages and services are running at any given time. The installed base is typically only 250MB for each DaDesktop server node.
  2. Access to the 'root' account is disabled in SSH.
  3. The DaDesktop infrastructure uses the newest stable version of Ubuntu Linux as its base, with automatic upgrades and patching to reduce the risk of zero-day vulnerabilities.
  4. Servers are monitored for known vulnerabilities.
  5. Unused packages and files are removed.
  6. NobleProg has access to all source code used in the project. If a vulnerability is discovered but a patch is unavailable, the NobleProg security team can apply a patch immediately.
  7. Systems are automatically updated via unattended-upgrades.
  8. All connections from our servers to the dark web are monitored and can be automatically blocked.
Monitoring
  1. NobleProg monitors all its servers, including DaDesktop servers, and generates alerts for any issues requiring attention. These alerts are followed up and resolved. Regular reviews of alerts and issues are conducted to ensure each problem is fully addressed, preventing recurrence.
  2. All DaDesktop servers and trainer/participant machines are monitored for CPU, memory, and network activity. Additionally, all DaDesktop nodes and the underlying system are monitored for any CVEs, which trigger flags on the monitoring system for review. Security updates are typically applied automatically, but in cases of exceptions identified here, manual patching and/or other mitigating measures are taken.
  3. Recordings are automatically captured on Fresh Start machines during courses, allowing Trainers to check for issues when preparing a course. Optional recordings can be made of the Trainer machine and Training Room during a course. This feature is fully controllable via the UI and can be disabled if not required.
  4. DaDesktop Operating System Templates are updated approximately every couple of weeks to include the latest security updates.