Italiano Login Register

Security

Ownership and Control
Redundancy and Failure Recovery
  1. Trainers and users have the option to replicate the entire desktop in real time using the 'remote replica' feature.
  2. To safeguard against experimental errors, automatic snapshots of the desktop can be enabled. In the event of a crash, the system can restore the last stable working version.
  3. Servers are hosted in redundant data centers; if one data center experiences a failure, another located at a low-latency distance becomes available to ensure continuity.
  4. The DaDesktop infrastructure utilizes a global network of data centers, all adhering to comprehensive physical and IT security policies.
  5. DaDesktop leverages QEMU/KVM to create and run virtual machines, both of which are native components of the Linux operating system. Because QEMU and KVM are built-in, security updates can be deployed quickly and easily without reliance on third parties. This stack boasts an excellent security and performance record, often outperforming commercial alternatives.
At NobleProg, a zero-trust policy is implemented
  1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff users with pre-registered IP addresses. IP tables firewall rules are strictly enforced to block SSH and other unauthorized port access.
  2. Each system is secured by Two Factor Authentication and passwords. An attacker who obtains a password will still be denied access because their IP address will not be whitelisted and they will lack the required One Time Password.
  3. In a DaDesktop course environment, each desktop network is isolated from other desktops and from public access to ensure security.
  4. All NobleProg staff use a MFA system to log in to NobleProg or DaDesktop systems. Access rights are revoked immediately upon an employee’s departure to prevent unauthorized access.
Linux Hardening
  1. The DaDesktop server (node) system is optimized by installing only essential packages on a custom, stripped-down version of Ubuntu. This minimization reduces complexity, overhead, and the number of running services, thereby decreasing potential security holes. Typically, the installed base for each DaDesktop server node is only around 250MB.
  2. Access to the 'root' account via SSH is disabled.
  3. The infrastructure is based on the latest stable version of Ubuntu Linux, with automatic upgrades and patching to mitigate the risk of zero-day vulnerabilities.
  4. Servers are continuously monitored for known vulnerabilities.
  5. Unused packages and files are regularly removed to maintain a lean system.
  6. NobleProg maintains access to all project source code. If a vulnerability is discovered but an official patch is unavailable, the NobleProg security team can implement a fix immediately.
  7. Systems receive automatic updates via unattended-upgrades.
  8. All connections from our servers to dark-web entities are monitored and can be automatically blocked.
Monitoring
  1. NobleProg monitors all servers, including those supporting DaDesktop, generating alerts for any issues requiring attention. These alerts are actively followed up and resolved, with regular reviews conducted to ensure issues are fully addressed and prevented from recurring.
  2. All DaDesktop servers and trainer or participant machines are monitored for CPU, memory, and network activity. Additionally, DaDesktop nodes and the underlying system are checked for CVEs, which trigger flags in the monitoring system. While security updates are typically applied automatically, any exceptions identified are patched manually or addressed through other mitigating measures.
  3. Automated recordings are captured on 'Fresh Start' machines to help trainers verify course preparations. Optional recordings of the trainer's machine and the training room can also be made during a course. This feature is fully controllable via the UI and can be disabled if not required.
  4. DaDesktop Operating System Templates are updated every few weeks to include the latest security patches.