DaDesktop is written by NobleProg Tech and maintained and developed entirely in-house—any issues are handled by our own specialist team of Security Ops, Devs, and DevOps staff. Only NP Tech personnel have access to the underlying DaDesktop system.
NobleProg has access and rights to use and modify all source code.
Redundancy and Failure Recovery
Trainers and users can choose to replicate an entire desktop in real time via the 'remote replica' option.
When experimenting, you can enable automatic snapshots of a desktop. If a crash occurs, the system can restore the last working version.
Servers are maintained in redundant data centres, so if one facility fails, another is available with low-latency distance.
The DaDesktop infrastructure uses a number of data centres located worldwide Canada, with comprehensive physical and IT security policies in place.
DaDesktop uses QEMU/KVM to create and run virtual machines; both QEMU and KVM are part of the Linux operating system. Since they are built-in components of the Linux OS, rolling out security updates is both straightforward and quick, with no reliance on third parties to worry about. QEMU/KVM has an excellent security and performance record, outperforming commercial solutions.
At NobleProg, a zero-trust policy is implemented
We only allow NP Tech staff whose IP addresses are pre-registered to access the NobleProg and DaDesktop systems we operate. IP tables firewall rules are used to block access for SSH and other ports.
Each system is protected by Two-Factor Authentication and a password, meaning an attacker who has only obtained a password cannot gain access because their IP wouldn't be whitelisted and they wouldn't have the One-Time Password.
During a DaDesktop course, each desktop network is isolated from other desktops and from public access.
NobleProg staff must all use an MFA system to log in to NobleProg or DaDesktop systems; access is revoked immediately if a staff member leaves, to safeguard our systems from unauthorised entry.
Linux Hardening
The DaDesktop server (node) system is minimised by installing only necessary packages—a custom, stripped-down version of Ubuntu that we build and manage to reduce added complexity and overhead. This, in turn, means fewer security holes, as there are fewer packages to run and fewer services active at any one time. The typical installed footprint is only 250MB for each DaDesktop server node.
Access to the 'root' account is disabled in SSH.
The DaDesktop infrastructure uses the newest stable version of Ubuntu Linux as a base, and it is automatically upgraded and patched, thereby reducing the risk of a zero-day vulnerability.
Servers are monitored for known vulnerabilities.
Unused packages and files are removed.
NobleProg has access to all source code used in the project. If a vulnerability is discovered but a patch is not yet available, the NobleProg security team can patch it immediately.
Systems are automatically updated (unattended-upgrades).
All connections from our servers to the dark web are monitored and can be automatically blocked.
Monitoring
NobleProg monitors all of its servers, including DaDesktop servers, and creates alerts for any issues that need attention. Alerts are followed up and resolved. We regularly review alerts and issues to ensure each one is fully addressed, preventing them from happening again.
We monitor all DaDesktop servers and trainer/participant machines for CPU, memory, and network activity, among other things. Additionally, all DaDesktop nodes and the underlying DaDesktop system are checked for any CVEs, which raise a flag on the monitoring system for review. Normally, security updates are applied automatically, but if any exceptions are picked up here, they are patched manually, and/or other mitigating steps can be taken.
Recordings are automatically taken of the Fresh Start machines on courses, which can be used to check for any issues when a Trainer prepares a course. Optionally, recordings can be made of the Trainer machine and Training Room during a course. This is fully controllable in the UI and can be switched off if not required.
DaDesktop Operating System Templates are updated, usually every couple of weeks, with the latest security patches applied.