Deutsch Login Register

Security

Ownership and Control
Redundancy and Failure recovery
  1. Trainers and participants have the option to replicate their entire desktop in real-time using the 'remote replica' feature.
  2. For experimental work, users can enable automatic snapshots of their desktop environment. This ensures that in the event of a system crash, the last stable version can be quickly restored.
  3. Infrastructure is hosted across redundant datacenters. Should one datacenter experience a failure, operations seamlessly shift to another location, maintaining low-latency performance.
  4. The DaDesktop infrastructure leverages a global network of datacenters, all adhering to rigorous physical and IT security standards.
  5. Virtual machines are created and executed using QEMU/KVM, components natively integrated into the Linux operating system. This integration simplifies the deployment of security updates and eliminates reliance on third-party dependencies. QEMU/KVM boasts a superior record in both security and performance compared to many commercial alternatives.
At NobleProg, a zero-trust policy is implemented
  1. Access to NobleProg and DaDesktop systems is restricted to NP Tech staff with pre-registered IP addresses. IP table firewall rules actively block unauthorized access to SSH and other sensitive ports.
  2. All systems enforce Two-Factor Authentication (2FA) alongside password protection. Even if a password is compromised, an attacker cannot gain entry without a whitelisted IP address and a valid One-Time Password.
  3. In DaDesktop course environments, each desktop network is isolated from other desktops and public internet access to ensure containment.
  4. Every NobleProg employee utilizes a Multi-Factor Authentication (MFA) system for logins. Access privileges are immediately revoked upon staff departure to prevent unauthorized access.
Linux Hardening
  1. DaDesktop server nodes run a custom, stripped-down version of Ubuntu containing only essential packages. This minimal configuration reduces complexity, overhead, and the attack surface by limiting the number of active services. The installed base on each node typically remains under 250MB.
  2. Direct access to the 'root' account via SSH is disabled to enhance security.
  3. The infrastructure is built on the latest stable version of Ubuntu Linux, with automated upgrades and patching to mitigate the risk of zero-day vulnerabilities.
  4. Continuous monitoring is applied to detect and address known vulnerabilities on servers.
  5. Unnecessary packages and files are removed to maintain a lean system profile.
  6. NobleProg maintains full access to the project's source code. If a vulnerability is identified without an available patch, the security team can implement immediate custom fixes.
  7. Systems utilize automatic updates (unattended-upgrades) to stay current.
  8. Any connections from servers to dark-web sites are monitored and can be automatically blocked to prevent malicious activity.
Monitoring
  1. NobleProg actively monitors all servers, including DaDesktop nodes, generating alerts for any anomalies. These alerts are promptly investigated and resolved, with regular reviews conducted to ensure root causes are addressed and prevent recurrence.
  2. Comprehensive monitoring tracks CPU, memory, and network activity across DaDesktop servers and user machines. Additionally, nodes and the underlying system are scanned for CVEs, triggering flags for verification. While security updates are generally applied automatically, exceptions are manually patched or mitigated as needed.
  3. Automatic recordings of Fresh Start machines are captured during courses to assist Trainers in verifying course setup. Optional recordings of Trainer machines and Training Rooms are also available, fully controllable via the UI and can be disabled if not required.
  4. DaDesktop Operating System Templates are refreshed every few weeks to incorporate the latest security updates.