TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Account Access Management & Permissions

240 posts · Jan 2013 – Sep 2026

What this trail covers

Cloudflare One's account access management and permissions have evolved to support granular controls for Workers and other Developer Platform products. This includes new roles (Metadata Read-Only, Content Read-Only, Editor, Admin) that can be applied at the Developer Platform, Product, or Resource level. These roles allow for fine-grained access control for both human users and agents, ensuring least privilege access. This system is being extended to other Developer Platform products like D1, R2. The integration with Okta for sharing user risk scores allows for dynamic enforcement of access policies based on real-time risk assessments, enhancing Zero Trust principles by incorporating rich context into access decisions.

All Cloudflare trails
  1. Give every teammate and agent the right level of access to your WorkersThis post introduces four new granular roles (Metadata Read-Only, Content Read-Only, Editor, Admin) for managing access to Cloudflare Workers at the resource level. It details how these roles can be applied to specific Workers, API tokens, and user groups, enabling fine-grained least privilege access for both human users and agents. The post also outlines the extension of these roles to other Developer Platform products like D1, R2, and KV, and highlights the improvement in error messages to include contextual information and links to relevant API documentation for required permissions.
  2. From all-or-nothing to task-based OAuth consentIntroduced OAuth scope customization, allowing client owners to mark specific scopes as optional when configuring an OAuth client. This enables users to grant a narrower subset of an application's requested access at authorization time, providing more granular control over delegated access. The system evaluates required and optional scopes against the specific authorization request, not the full client configuration. Developers must check the granted scope set after authorization, as access tokens will only contain consented scopes.
  3. How Cloudflare detects MCP traffic and helps secure itThis post introduces new Cloudflare One capabilities to detect and control Model Context Protocol (MCP) traffic generated by AI agents. It details the anatomy of an MCP tool call, highlighting key signals like hostnames, paths, authorization headers, and the MCP-Protocol-Version header. It explains three control points: inside the MCP client, at the network boundary (via Secure Web Gateway and TLS decryption), and before the MCP server invokes the tool. Cloudflare Gateway uses protocol signals to find 'shadow MCP traffic' and enforce MCP Portal-only access. The post also discusses the limitations of URL-based detection and the importance of the MCP-Protocol-Version header as a more specific indicator.
  4. Secure all your internal vibe-coded applications — in one clickThis post introduces the ability to apply Cloudflare Access policies directly to Cloudflare Workers, either at the account level or on individual Workers. This allows for all internal applications hosted on Workers to be private by default, simplifying security for internal developer platforms and individual applications. Key features include account-level policies for all Workers (preview and production), individual Worker policies, and the ability to bypass the account-wide policy for specific Workers. It also introduces the ability to access authenticated user identity (email, name, groups) directly within the Worker's context object (`ctx.access.getIdentity()`), eliminating the need for manual JWT validation. Local testing is supported via `wrangler.jsonc` configuration. The underlying implementation leverages the new Rust-based modular proxy (FL2) to split Workers routing from execution, allowing Access policies to be enforced earlier in the request pipeline.
  5. The Agent Access ModelThis post introduces the Agent Access Model (AAM) as an evolution of Zero Trust principles for managing software principals (agents). AAM proposes a model where agents receive short-lived, task-scoped, sender-constrained credentials. Authorization decisions are made per action against the task's accumulated state and policy, rather than trusting the agent's identity or the network. Key components include an Agent Identity Broker for issuing credentials, a Task-Scoped Access Engine for making authorization decisions based on task templates and capability ceilings, and a Mediation Layer (harness and network) for enforcing policy at the point of action. The model emphasizes making agent capabilities smaller and enforcing least privilege in real-time.
  7. Unlocking the Cloudflare app ecosystem with OAuth for allThis post details the upgrade of Cloudflare's OAuth engine from Hydra 1.X to 2.X, a significant undertaking involving database schema migrations and a blue-green deployment strategy. Key technical challenges and solutions included: rewriting SQL migrations to use `CREATE INDEX CONCURRENTLY` and custom Hydra versions to avoid exclusive locks and `SELECT *` operations; implementing a blue-green upgrade strategy for Hydra 2.X that allowed writes to the database during the migration window by increasing token expiry times and using Cloudflare Queues to capture and replay revocation events; addressing refresh token reuse issues in Hydra 1.X by implementing refresh token coalescing in the OAuth traffic routing Worker; and mitigating post-upgrade issues like an overeager data cleanup job by restoring data and improving OAuth authorization behaviors. The upgrade resulted in improved performance and reliability of the OAuth system, paving the way for the release of self-managed OAuth.
  8. Temporary Cloudflare Accounts for AI agentsIntroduced temporary Cloudflare accounts for AI agents, allowing `wrangler deploy --temporary` to provision a Worker with a temporary API token for 60 minutes. This enables frictionless trial-and-error deployments for agents without human intervention, with an option to claim the temporary account permanently.
  9. Introducing the Cloudflare One stack- agent-powered deploymentIntroduces the Cloudflare One stack, a set of agent skills designed to automate the configuration, deployment, and management of Zero Trust environments. This includes skills for migrating from legacy vendors like Zscaler and Palo Alto Networks, network diagram interpretation and generation, vendor concept translation, and troubleshooting with the Digital Experience Monitoring (DEX) toolkit. The stack provides a typed interface to the Cloudflare API for agents via the MCP server, enabling them to query, inspect, and modify configurations.
  10. Agents can now create Cloudflare accounts, buy domains, and deployThis post introduces a new protocol co-designed with Stripe that enables agents to provision Cloudflare accounts, start paid subscriptions, register domains, and obtain API tokens on behalf of users. This protocol builds on existing standards like OAuth and OIDC, and incorporates payment tokenization to allow agents to spend within defined budgets. The system includes a service catalog for agents to discover available services and an authorization flow where Stripe acts as the identity provider. This significantly reduces friction for end-users by allowing agents to perform these setup tasks without manual human intervention beyond initial authorization.
  11. Securing non-human identities: automated revocation, OAuth, and scoped permissionsIntroduced scannable API token formats ('cf' prefix and checksum) for improved detection by credential scanners. Implemented automated revocation of leaked tokens via GitHub Secret Scanning. Enhanced OAuth consent experience with a centralized 'Connected Applications' view for managing third-party access and scopes. Expanded resource-scoped RBAC to include Access Applications, allowing for fine-grained permissions at the resource level.
  12. Managed OAuth for Access: make internal apps agent-ready in one clickIntroduces managed OAuth for Cloudflare Access applications, allowing agents to authenticate using OAuth 2.0 flows (RFC 9728, RFC 7591, RFC 7636) by discovering authorization server information at /.well-known/oauth-authorization-server. This eliminates the need for service accounts and static credentials for agent access to internal applications, ensuring actions are attributable to human users and enabling agents to interact with web pages, web apps, and REST APIs behind Access policies.
  13. How we built Organizations to help enterprises manage Cloudflare at scaleIntroduced Cloudflare Organizations, a new layer above individual accounts, to manage collections of accounts for enterprises. This feature is built on the Tenant system and provides a centralized management plane for users, configurations, and analytics across multiple Cloudflare Accounts. Key features include an account list, the 'Org Super Administrator' role with Super Administrator permissions across all accounts in the organization, a roll-up analytics dashboard for HTTP traffic, and the ability to share configurations like WAF and Gateway policies across accounts. The implementation involved significant code changes (133k new lines, 32k removed) and a 27% performance improvement in permission enumeration calls.
  14. From legacy architecture to Cloudflare OneThis post details a methodology for migrating legacy applications to a Zero Trust architecture using Cloudflare One and CDW's expertise. It introduces a tiered application categorization (Tier 0-3) based on migration effort and complexity, with specific examples of how Cloudflare Access and Tunnel are used to 'wrap' legacy applications. It outlines a pre-migration audit process focusing on architectural readiness, identity providers, dependency mapping, and establishing firebreaks. The phased rollout strategy (Strategy & Infrastructure, Pilot Rollout, Production Scaling) emphasizes coexistence and a safe rollback path. The post highlights the use of Cloudflare Access policies for identity, device posture, and MFA checks, and the role of Cloudflare Tunnel in hiding applications from the public internet. It also touches on performance as a security feature with a single-pass architecture and post-quantum encryption.
  15. Complexity is a choice. SASE migrations shouldn’t take years.This post details how Cloudflare One, an agile SASE platform, is enabling partners to significantly reduce SASE migration timelines from 18 months to as little as six weeks. It highlights the technical advantages of Cloudflare One over legacy SASE products, including identity-first on-ramps, consolidated policy engines, and cloud-native connectors like `cloudflared`. The post also showcases the extensibility of the Cloudflare One architecture, demonstrated by a partner extending the client to support Arch Linux. Furthermore, it introduces the Cloudflare AI Security Suite, detailing features for securing workforce AI usage (Shadow AI visibility, AI confidence scores, DLP AI prompt protection) and AI-powered applications (Firewall for AI, LLM discovery, request validation, response scrubbing), as well as securing agentic AI with MCP server portals.
  16. From the endpoint to the prompt: a unified data security vision in Cloudflare OneThis post introduces several updates to Cloudflare One's data security vision. New features include browser-based RDP clipboard controls to restrict data movement between local devices and RDP sessions, enhancing productivity-security tradeoffs. Operation mapping has been extended to logging, providing richer context in events for SaaS applications, simplifying policy authoring and investigations. On-device Endpoint DLP is being brought to the Cloudflare One Client to enforce data protection on endpoints, starting with clipboard movement. Finally, API CASB now scans Microsoft 365 Copilot activity for data security issues, including chats and uploads matching DLP profiles, providing rich context for findings.
  17. A QUICker SASE client: re-building Proxy ModeRe-built the Cloudflare One Client's proxy mode from the ground up, deprecating WireGuard for proxy mode in favor of QUIC. This involves leveraging MASQUE (part of QUIC) for proxying IP packets and using QUIC streams for direct L4 proxying via HTTP/3 with the CONNECT method. This architectural shift bypasses smoltcp, leverages native QUIC benefits for congestion and flow control, and allows for tuneable parameters, resulting in doubled download/upload speeds and decreased latency.
  18. Mind the gap: new tools for continuous enforcement from boot to loginIntroduces mandatory authentication for the Cloudflare One Client on Windows, which blocks all internet traffic by default until the user authenticates. This addresses the gap between client installation and user authentication, ensuring managed devices are accounted for. Additionally, it announces independent multi-factor authentication (MFA) for Cloudflare Access, acting as a secondary root of trust separate from the primary Identity Provider. This MFA supports biometrics, security keys (WebAuthn/FIDO2), and TOTP, and can be configured with granular policies for specific applications or user groups.
  19. Defeating the deepfake: stopping laptop farms and insider threatsThis post introduces the integration of Nametag's workforce identity verification into Cloudflare Access, a component of Cloudflare One. This integration addresses the 'identity assurance gap' in zero trust models by verifying the human behind the request, not just the device or credentials. It leverages OpenID Connect (OIDC) to allow Nametag to act as an identity provider or an external evaluation factor. The workflow involves users authenticating with Nametag via selfie and government-issued ID, which then returns an ID token to Cloudflare Access for policy enforcement. This complements existing insider threat protections like DLP and RBI by providing identity assurance at the point of onboarding and potentially for continuous verification in the future.
  20. Moving from license plates to badges: the Gateway Authorization ProxyIntroduced the Gateway Authorization Proxy and Proxy Auto-Configuration (PAC) File Hosting to enable identity-based access control and filtering for unmanaged devices. The Authorization Proxy uses signed JWT cookies to track user identity across requests to specific domains, redirecting to Cloudflare Access for initial authentication if no cookie is present. PAC File Hosting allows Cloudflare to host PAC files, simplifying setup and integrating with an AI assistant for understanding PAC file logic. This expands clientless security options and supports multiple identity providers.
  21. Stop reacting to breaches and start preventing them with User Risk ScoringThis post introduces User Risk Scores as a new capability within Cloudflare One's SASE platform. It details how user behavior telemetry (e.g., impossible travel, DLP violations, failed logins) is collected from Cloudflare Access and Gateway, and integrated with third-party signals (e.g., CrowdStrike, SentinelOne). The risk score calculation logic is deterministic, involving selection of enabled behaviors, aggregation of events, scoring based on the highest risk level, and manual reset functionality. The post also describes how these risk scores can be applied in Adaptive Access policies within Cloudflare Access to dynamically adjust user permissions, and how these signals can be shared back to Identity Providers via the Shared Signals Framework.
  22. See risk, fix risk: introducing Remediation in Cloudflare CASBThis post introduces Remediation capabilities to Cloudflare CASB, allowing users to directly fix security findings. It details the architecture of the remediation system, which uses Cloudflare Workers, Workflows, Queues, KV, Secrets Store, and Hyperdrive. The initial focus is on fixing file-sharing issues in Microsoft 365 and Google Workspace. The post highlights the system's speed, durability, and ease of use, with average end-to-end job completion times of 48 seconds (p50) and 72 seconds (p90). It also outlines future plans for quarantine actions, custom webhooks, autoremediation, custom findings, bulk remediation, and expanded SaaS integrations.
  23. Beyond the blank slate: how Cloudflare accelerates your Zero Trust journeyIntroduced Project Helix, a system that codifies Cloudflare One expertise and automates the deployment of Zero Trust configurations. Project Helix leverages Terraform templates and a web-based UI hosted on Cloudflare Workers and Containers to allow users to quickly deploy baseline security policies across DNS, network, and HTTP protocols. This includes features like TLS inspection, QUIC/HTTP3 security, Remote Browser Isolation for risky domains, visibility and controls for AI applications, and tenant control policies for SaaS applications. It also optimizes traffic routing for real-time communication apps and handles captive portals. The system is internationalized and significantly reduces deployment time from weeks to minutes.
  24. Modernizing with agile SASE: a Cloudflare One blog takeoverThis post announces innovations to Cloudflare One, positioning it as an agile and composable SASE platform. It details how Cloudflare One converges networking and security into a single, global connectivity cloud built on a global network. Key technical aspects include a single-pass architecture that runs security checks on every server simultaneously, eliminating service-chaining and enabling weightless security. The post outlines a week of technical deep-dives covering network foundation, identity evolution, AI for security, autonomous edge performance, and unified enterprise solutions. It highlights the composable and programmable nature of the platform, its integration with Cloudflare Workers for real-time security event interception, and immediate use cases such as remote access modernization, email phishing protection, DNS filtering, safe AI adoption, and simplified branch networking.
  25. The truly programmable SASE platformThis post details how Cloudflare's SASE platform (Cloudflare One) is becoming more programmable by integrating deeply with its Developer Platform (Cloudflare Workers). It introduces the concept of 'programmability' beyond basic APIs, focusing on the ability to intercept security events, enrich them with external context, and act on them in real time. The post highlights the ability to extend policy decisions with custom logic, such as calling external risk APIs, injecting dynamic headers, or validating browser attributes, all executed at the edge via Workers. It provides a concrete example of automated device session revocation using a scheduled Worker that queries the Devices API to revoke inactive registrations. The post also outlines future plans for custom actions in Cloudflare Gateway to support dynamic policy enforcement and request augmentation.
  26. Securing data in SaaS to SaaS applicationsIntroduces a new SaaS to SaaS proxy solution that addresses security blind spots in integrations between SaaS applications. The solution leverages Cloudflare's reverse proxy network to sit in front of SaaS applications, enabling data owners to gain visibility into data access, instantly shut off access, and detect anomalies. It also details two deployment approaches: one for data owners using vanity hostnames and another for SaaS vendors using Cloudflare for SaaS. A key technical innovation is the use of 'key splitting' to cryptographically divide bearer tokens into two fragments, Part A and Part B, where Part A is given to the integration and Part B is stored by Cloudflare. This prevents either fragment from being usable alone, enabling secure token management, instant revocation, and audit trails without storing complete credentials.
  27. Integrating CrowdStrike Falcon Fusion SOAR with Cloudflare’s SASE platformThis post introduces integrations between Cloudflare One's Zero Trust platform and CrowdStrike Falcon Fusion SOAR. Specifically, it details how Cloudflare Access policies (reusable policies, access groups, application policies) can be programmatically updated and application tokens can be revoked via API calls triggered by CrowdStrike security events. This extends the existing account access management capabilities by enabling automated response actions on Cloudflare's Zero Trust platform based on threat intelligence from CrowdStrike.
  28. A deep dive into Cloudflare’s September 12, 2025 dashboard and API outageThis post details a significant outage caused by a bug in the dashboard leading to excessive calls to the Tenant Service API, which is critical for API request authorization. It highlights the impact on both the dashboard and other APIs, the response taken to mitigate the issue, and crucial lessons learned regarding release management (Argo Rollouts), 'thundering herd' problem mitigation, capacity planning for critical services, and the need for improved observability to differentiate between retries and new API requests.
  29. Introducing simple and secure egress policies by hostname in Cloudflare’s SASE platformIntroduced hostname, domain, content category, and application-based egress policies within Cloudflare Gateway. This was achieved by leveraging Cloudflare's DNS resolver to associate DNS queries with network connections and using a synthetic IP mechanism to tag traffic destined for specific hostnames before Layer 4 connection establishment, overcoming the limitation of evaluating egress policies before Layer 7 information is available.
  30. Everything you need to know about NIST’s new guidance in “SP 1800-35: Implementing a Zero Trust Architecture”This post summarizes NIST SP 1800-35, "Implementing a Zero Trust Architecture (ZTA)", highlighting its reference architecture for Zero Trust Architecture (ZTA) and demonstrating how Cloudflare's Zero Trust product suite integrates with other vendors to support this architecture. It details the logical components of the ZTA reference architecture (PEP, PE, PA, PDP, PIP) and explains Cloudflare's role in enabling a ZTA that maps to NIST's reference architecture, including compliance with FedRAMP and post-quantum cryptography standards.
  31. Introducing Cloudflare Secrets Store (Beta): secure your secrets, simplify your workflowIntroduces Cloudflare Secrets Store (Beta) for centralized management, improved security, and restricted access to sensitive values across Cloudflare products, starting with Workers. Secrets are encrypted using a two-level key hierarchy (DEK/KEK) and propagated via Quicksilver. It introduces new RBAC roles (Secrets Store Admin, Reporter, Deployer) for granular control over secrets and allows secrets to be scoped to specific Cloudflare products. Integrates with Workers via bindings and Wrangler CLI.
  32. Open-sourcing OpenPubkey SSH (OPKSSH): integrating single sign-on with SSHThis post introduces OpenPubkey SSH (OPKSSH), an open-source project that integrates single sign-on (SSO) with SSH. OPKSSH allows users to authenticate to SSH servers using OpenID Connect (OIDC) tokens, eliminating the need for manual SSH key management. It achieves this by generating ephemeral SSH keys on-demand, obtaining a PK Token from an OIDC provider that commits to the ephemeral key and user identity, and then packaging this PK Token into an SSH certificate extension. The SSH server uses an AuthorizedKeysCommand to invoke the OpenPubkey verifier, which validates the PK Token and checks user authorization based on the identity claims within the token. This approach enhances security through ephemeral keys and improves usability by simplifying the SSH login process.
  33. Detecting sensitive data and misconfigurations in AWS and GCP with Cloudflare OneThis post introduces Cloudflare CASB's integration with AWS S3 and Google Cloud Storage for posture management and Data Loss Prevention (DLP). It details the serverless architecture (Compute Account, Controller, Crawler, Scanner) used for scanning sensitive data within customer environments. New DLP functionality allows for pre-built or custom regex-based detection profiles, and posture management identifies misconfigurations in IAM, bucket settings, and access controls. The feature aims to prevent data exposure and ensure compliance.
  34. RDP without the risk: Cloudflare's browser-based solution for secure third-party accessIntroduced browser-based RDP support for Windows servers, integrating with Cloudflare Access for authentication, authorization, and auditing. Leverages IronRDP client within the browser, encapsulated in WebSockets, to communicate with a dedicated WebSocket proxy. This proxy authenticates clients, terminates WebSockets, and forwards tunneled RDP traffic deeper into Cloudflare's infrastructure. The solution eliminates the need for RDP client software and VPNs, providing a secure and performant alternative for third-party access.
  35. Improved support for private applications and reusable access policies with Cloudflare AccessThis post introduces the ability to define private applications (those accessible via private IP addresses or hostnames) directly within Cloudflare Access, mirroring the experience for public hostname applications. It also introduces reusable access policies, allowing administrators to define policies once and apply them across multiple applications. Previously, private application access was handled via Cloudflare Gateway, creating an inconsistent user experience. This update integrates private application management directly into Access, enabling consistent ZTNA for both public and private resources, and supporting non-browser applications like SSH and RDP.
  36. Advancing account security as part of Cloudflare’s commitment to CISA’s Secure by Design pledgeThis post details Cloudflare's efforts to enhance account security in alignment with CISA's Secure By Design pledge, specifically focusing on increasing Multi-Factor Authentication (MFA) adoption. New features include social logins with Google and Apple, which leverage the partners' existing MFA requirements, and leaked password notifications that prompt users to change compromised credentials. For administrators, the ability to require MFA for all users in an account has been introduced. The post also reiterates the importance of strong, user-generated passwords and phishing-resistant security keys, and encourages SSO for enterprise customers. While the post mentions account access management and permissions in the context of the pledge, its primary technical contribution is in the area of user authentication and account security enhancements.
  37. Automatic Audit Logs: new updates deliver increased transparency and accountabilityThis post introduces the "Automatic Audit Logs" system, which unifies audit logging across Cloudflare products. It expands coverage from 62 to 111 products, standardizes log generation, captures GET requests and failed attempts, and provides granular filtering and enhanced context. The technical implementation involves the API Gateway streaming requests to an Audit Log Redactor Worker via RPC, which uses the OpenAPI Schema to redact sensitive information. The sanitized data is then processed by an Ingestor service, enriched with user and authentication details, and stored in a database. The beta release stores 30 days of logs, with plans for 18 months in GA. Upcoming enhancements include a Dashboard UI, extraction of system-initiated actions, and export via Logpush.
  38. Resolving a Mutual TLS session resumption vulnerabilityThis post details a vulnerability in Cloudflare's Mutual TLS (mTLS) implementation related to session resumption. A flaw in BoringSSL's session cache partitioning allowed a client with a valid mTLS certificate for one zone to resume a TLS session with another zone without re-authentication. The vulnerability was mitigated by disabling TLS session resumption for all mTLS-enabled customers. The post also outlines how customers can further harden their mTLS configurations using Transform Rules, logging, and WAF custom rules, including checking the Issuer's SKI for an additional layer of security. It provides examples of headers passed to the origin and how to log this information.
  39. What’s new in Cloudflare: Account Owned Tokens and Zaraz Automated ActionsThis post introduces Account Owned Tokens, a new feature that allows API tokens to be owned by an account rather than an individual user. This provides a more flexible and auditable way to manage access for services and long-running applications, decoupling token permissions from individual user lifecycles. It also introduces Zaraz Automated Actions, which simplifies the setup of third-party tools on websites by automating common event tracking actions like pageviews and custom events, reducing manual configuration.
  40. Fearless SSH: short-lived certificates bring Zero Trust to infrastructureThis post introduces Access for Infrastructure, a new feature within Cloudflare One that extends Zero Trust principles to privileged infrastructure access. It specifically details the implementation of short-lived SSH access, replacing traditional SSH keys and passwords with certificates signed by a Cloudflare-managed Certificate Authority (CA). The feature allows for granular policy-based access control, SSO/MFA/device posture authentication, and auditing of SSH sessions. It integrates with existing Cloudflare One deployments via WARP and Cloudflare Tunnel, and requires server-side configuration to trust the Cloudflare SSH CA. The short-lived nature of the certificates (3 minutes for authentication) significantly reduces the risk of compromise.
  41. Protect against identity-based attacks by sharing Cloudflare user risk scores with OktaThis post introduces the integration of Cloudflare's user risk scores with Okta's Identity Threat Protection. The integration leverages the OpenID Shared Signals Framework Specification (SSF) and Security Event Tokens (SETs) to transmit real-time risk telemetry from Cloudflare to Okta. When a user's risk score changes (e.g., due to impossible travel, DLP detections, or endpoint infections), Cloudflare sends a signed SET to Okta. Okta then uses this information to enforce policies, such as requiring MFA or logging out the user, thereby dynamically managing security posture based on user risk.
  42. Cloudflare acquires Kivera to add simple, preventive cloud security to Cloudflare OneThis post announces the acquisition of Kivera, which adds preventative, inline controls to Cloudflare One for enforcing secure configurations of cloud resources. It inspects cloud API traffic to provide enhanced visibility and granular controls for mitigating risks, managing cloud security posture, and streamlining DevOps processes. Key capabilities include one-click security for misconfigurations, enforced cloud tenant control, prevention of data exfiltration, reduction of 'shadow' cloud infrastructure, streamlined compliance, and a flexible DevOps model. This complements existing CSPM and CNAPP tools and integrates with Cloudflare's connectivity cloud.
  43. Cloudflare acquires BastionZero to extend Zero Trust access to IT infrastructureCloudflare acquires BastionZero to extend Zero Trust Network Access (ZTNA) to infrastructure resources like servers, Kubernetes clusters, and databases. This integration aims to replace traditional bastion hosts and PAM solutions by providing native access management for protocols like SSH, RDP, and Kubectl. BastionZero's approach uses OpenPubkey for identity binding to cryptographic keys, enabling SSO for infrastructure access with multiple roots of trust. Key additions include frictionless privileged access management (PAM) with ephemeral credentials, a DevOps-focused approach for securing SSH connections with session recording, and clientless RDP. Future features will be integrated into Cloudflare One, with initial functionality included in the free tier for organizations under 50 users.
  44. Unified Risk Posture Management by Cloudflare | Use CasesThis post introduces 'Cloudflare for Unified Risk Posture,' a new suite that converges SASE and WAAP capabilities to provide automated and dynamic risk posture enforcement. It details how Cloudflare evaluates risk across people and applications, exchanges risk indicators with partners like CrowdStrike and Okta, and enforces automated risk controls at scale. Key use cases include enforcing Zero Trust with CrowdStrike, leveraging user risk scores based on device posture, and integrating with SIEM/XDR platforms. This significantly expands the platform's ability to manage risk posture by offering a unified approach to risk evaluation, exchange, and enforcement.
  45. Introducing WARP Connector: paving the path to any-to-any connectivityIntroduced WARP Connector, an extension of the WARP client, to enable bidirectional, site-to-site, and mesh-like connectivity within Cloudflare One. This new connector addresses limitations of cloudflared by proxying at Layer 3, preserving true source IP addresses, and providing a unified experience for connecting users and networks. It supports use cases like VOIP/SIP servers and CI/CD pipelines by acting as a virtual router for subnets, allowing traffic to on/off-ramp through Cloudflare's global network.
  46. Eliminate VPN vulnerabilities with Cloudflare OneThis post details how Cloudflare One's SASE platform, specifically its Zero Trust Network Access (ZTNA) service, addresses vulnerabilities found in legacy VPN solutions like Ivanti Connect Secure. It highlights how ZTNA enforces the principle of least privilege, limiting lateral movement for attackers, and how Cloudflare's platform design prevents external access to system internals, mitigating risks associated with appliance compromises. The post also references Cloudflare's WAF proactively detecting the Ivanti zero-day vulnerabilities.
  47. Zero Trust WARP: tunneling with a MASQUEThis post announces the integration of the MASQUE protocol into Zero Trust WARP. MASQUE, built on HTTP/3 and QUIC, replaces WireGuard as the tunneling protocol for Zero Trust WARP. Key benefits highlighted include improved connectivity from anywhere by using standard ports (443), enhanced performance on lossy networks due to QUIC's multiplexing and packet coalescing, and support for FIPS-compliant cipher suites. This integration addresses customer demands for traffic that looks like HTTPS and meets compliance requirements, marking a significant step in the evolution of Cloudflare's Zero Trust offering.
  48. Securing Cloudflare with Cloudflare: a Zero Trust journeyThis post details Cloudflare's internal implementation of Zero Trust principles using its own products, including Cloudflare Access for application security, Magic WAN and Zero Trust Agent for network security and threat defense, and Cloud Email Security for inbox protection. It emphasizes the balance between security and privacy, outlining organizational controls and technological solutions. Key aspects include granular HTTP controls, remote browser isolation, data loss prevention, CASB, and email link isolation. The post also highlights privacy-preserving measures like data minimization, de-identification, transparent communication with employees, and granular control over PII in logs.
  49. Protecting APIs with JWT ValidationIntroduces JWT Validation as a new feature within API Gateway, enhancing security by allowing customers to validate incoming JSON Web Tokens (JWTs). This feature addresses four key customer requests: support for Bearer token format, multiple JWKS configurations, validation of JWTs sent in cookies, and exclusion of specific endpoints from validation rules. The post explains the threat of broken authentication, primers on authentication/authorization and JWT structure, and details how JWT validation protects against missing/broken authentication and expired token reuse.
  50. Introducing behavior-based user risk scoring in Cloudflare OneIntroduces Zero Trust user risk scoring to Cloudflare One, leveraging AI/ML to analyze real-time user behavior telemetry. This feature assigns dynamic risk scores (Low, Medium, High) to users based on observed activities, such as 'impossible travel' and DLP triggers. It builds upon existing Zero Trust logs and enables administrators to define behavioral rules to adapt security posture and detect account compromises or policy violations.
  51. Enhancing security analysis with Cloudflare Zero Trust logs and Elastic SIEMThis post announces the integration of Cloudflare Zero Trust logs with Elastic SIEM, providing pre-built dashboards for analyzing Gateway HTTP and CASB events. It details the value of this integration for comprehensive visibility, field normalization, efficient search, correlation, and threat detection. It also outlines the setup process via Logpush jobs and enabling the integration in Kibana.
  52. Fulfilling the promise of single-vendor SASE through network modernizationThis post announces updates to Cloudflare One to further the promise of a single-vendor SASE architecture. It introduces flexible on-ramps for site-to-site connectivity supporting agent/proxy-based and appliance/routing-based implementations, simplifying SASE networking for security and networking teams. New WAN-as-a-service (WANaaS) capabilities include high availability, application awareness, a virtual machine deployment option, and enhanced visibility and analytics. It also introduces Zero Trust connectivity for DevOps with mesh and peer-to-peer (P2P) secure networking capabilities extending ZTNA to service-to-service workflows and bidirectional traffic.
  53. Introducing advanced session audit capabilities in Cloudflare OneIntroduced advanced session audit capabilities for Cloudflare One, allowing administrators to view active user sessions and associated data used by Zero Trust policies. This feature leverages Cloudflare Workers KV to store user identity information (IdP claims, device posture, network context) at the time of authentication, enabling improved troubleshooting without requiring users to share JWTs or HAR files. This enhances the ability to diagnose Zero Trust deployments by providing a centralized view of session data.
  54. Introducing HAR Sanitizer: secure HAR sharingThis post introduces the HAR Sanitizer, a new open-source tool that addresses a critical security vulnerability exposed by the Okta breach. It allows users to sanitize HTTP Archive (HAR) files by removing sensitive session cookies and JWTs before sharing them for debugging. This directly enhances the security of troubleshooting processes within the context of Cloudflare's Zero Trust offerings, particularly for Cloudflare Access, by preventing session hijacking and unauthorized access.
  55. How Cloudflare mitigated yet another Okta compromiseThis post details how Cloudflare's Zero Trust architecture, specifically Cloudflare Access, Gateway, and Data Loss Prevention, was instrumental in mitigating a security incident originating from a compromise of Okta's systems. It highlights the effectiveness of real-time detection and rapid response in preventing impact to Cloudflare customer information and systems, even when faced with sophisticated attacks involving compromised employee accounts and session tokens. The post also provides recommendations for Okta and its customers to enhance security practices, particularly around multi-factor authentication and monitoring.
  56. Welcome to connectivity cloud: the modern way to connect and protect your clouds, networks, applications and usersThis post introduces the concept of a 'connectivity cloud' as the next evolution of Cloudflare's platform. It frames the company's existing and future offerings as a unified, intelligent platform for any-to-any connectivity and security across diverse digital environments. This builds upon the existing thread of account access management and permissions by positioning these capabilities as integral components of this broader connectivity vision, emphasizing how they contribute to restoring control and simplifying complex IT and security challenges for customers.
  57. What’s next for Cloudflare One’s data protection suiteThis post announces the launch of Cloudflare One for Data Protection, a unified suite that converges DLP, CASB, ZTNA, SWG, RBI, and cloud email security services. It recaps the DLP and CASB capabilities launched in the past year, highlighting improvements in customization, deep detections, and detailed detections for DLP, and expanded API integrations, strengthened findings, and convergence with DLP for CASB. It also previews new and upcoming functionality including exact data matching with custom wordlists, detection of source code and health data, and further convergence of API-driven CASB & DLP for data-at-rest protections in Microsoft 365 and GitHub.
  58. Integrate Cloudflare Zero Trust with Datadog Cloud SIEMThis post announces the general availability of Cloudflare Zero Trust Integration with Datadog Cloud SIEM. It details how customers can aggregate Cloudflare Zero Trust logs (including Access Requests, Audit logs, CASB findings, Gateway logs, and Zero Trust Session Logs) into Datadog for enhanced threat detection, investigation, and automated response. Key contributions include out-of-the-box dashboards and detection rules for CASB findings and impossible travel scenarios, significantly improving security insights and accelerating response times within the Zero Trust ecosystem.
  59. Protecting data on Apple devices with Cloudflare and JamfThis post details the integration of Cloudflare's Zero Trust Solutions (DLP, RBI, SaaS Tenancy Controls) with Jamf's management of Apple devices. It outlines how Jamf customers can leverage Magic WAN to steer traffic to Cloudflare for inspection, enabling SSL/TLS decryption for content inspection of HTTPS traffic. Specific steps are provided for implementing DLP, RBI, and SaaS Tenancy Control, highlighting the use of Jamf Pro for profile deployment and Cloudflare One for policy configuration. This expands the reach of Cloudflare's Zero Trust platform to managed Apple endpoints.
  60. Descale your network with Cloudflare’s enhanced Descaler ProgramThis post introduces the enhanced Descaler Program, which facilitates the migration of Zscaler customers to Cloudflare One. It highlights the program's ability to accelerate the transition of security configurations, policies, and lists, reducing migration time from days to hours or even minutes. Key contributions include the addition of configuration summary views and Terraform output options to the Descaler tooling, addressing customer feedback and enabling infrastructure-as-code workflows.
  61. Announcing Cloudflare Secrets StoreCloudflare is launching Secrets Store, a new secrets management offering that allows customers to store sensitive information like API tokens and shared secrets. This builds upon the existing Workers secrets functionality by introducing account-level secrets that can be referenced across multiple Workers scripts and functions. It also extends to other Cloudflare services like the Web Application Firewall (WAF) for managing authorization header values. The Secrets Store will offer granular scope permissions for access control, extensive audit logs for tracking secret access and usage, and the ability for customers to rotate their encryption keys.
  62. A complete suite of Zero Trust security tools to help get the most from AIThis post introduces Cloudflare One for AI, a collection of features designed to enable safe usage of AI services. It details how Cloudflare Gateway can be used to passively observe AI service usage for IT budgeting and security policy scoping. It also explains how to control API access to sensitive data using service tokens, granular access policies (verifying service tokens, country, IP address, or mTLS certificates), and Cloudflare Tunnel for outbound-only connections. Furthermore, it highlights the use of Data Loss Prevention (DLP) to restrict data uploads by scanning for sensitive information and building granular rules based on user groups, and mentions the upcoming integration of Cloudflare's CASB with AI services for misconfiguration scanning.
  63. Protect your domain with Zone HoldsIntroduces Zone Holds, a new capability for enterprise customers that prevents multiple Cloudflare accounts from managing the same domain. This feature enforces that only one account can contain a given domain, optionally including subdomains or custom hostnames, unless explicit permission is granted by the account owner. Zone Holds are enabled by default for enterprise zones and can be managed from the Zone Overview screen, with options to extend to subdomains and set re-enablement timers.
  64. Wildcard and multi-domain support in Cloudflare AccessIntroduced Multi-Domain Applications and Wildcard Support for Cloudflare Access. Multi-Domain Applications allow protection of multiple subdomains with a single Access app, simplifying configuration and enabling JWT cookie issuance across associated hostnames. Wildcard Support allows defining application patterns using '*' in subdomains or paths, enabling protection of hundreds of applications with a single policy. The most specific hostname definition takes precedence.
  65. Cloudflare Access is the fastest Zero Trust proxyThis post presents performance benchmarks comparing Cloudflare Access against Zscaler Private Access and Netskope Private Access. It details methodology for measuring response times and connect times from 300 global locations to 6 application servers, highlighting Cloudflare's 50% faster response time than Zscaler and 75% faster than Netskope. Specific data is provided for Toronto and South America, demonstrating Cloudflare's superior performance in both new and existing session scenarios. The post emphasizes the importance of performance for Zero Trust adoption and effectiveness.
  66. Introducing custom pages for Cloudflare AccessIntroduced customizable pages for Cloudflare Access, including login, block, and application launcher screens. This allows administrators to tailor the user experience with their own branding and messaging, reducing confusion and improving communication for large enterprises adopting Zero Trust. The customization builds upon the existing template used for reverse proxy customers.
  67. Adding Zero Trust signals to Sumo Logic for better security insightsThis post announces the expansion of Cloudflare's Logpush integration with Sumo Logic's Cloud SIEM to include automated normalization and correlation of Zero Trust logs. This enhances visibility into Cloudflare Gateway (Network, DNS, HTTP), Remote Browser Isolation, Data Loss Prevention, Access, and Cloud Access Security Broker logs, providing joint customers with deeper context into their security posture and accelerating the triage process for security analysts.
  68. Scan and secure Atlassian with Cloudflare CASBIntroduced new integrations for Cloudflare CASB with Atlassian Confluence and Jira, enabling scanning for application-specific security issues such as publicly shared content, unauthorized access, and third-party app access issues. This expands the list of supported SaaS applications for CASB.
  69. Zero Trust security with Ping Identity and Cloudflare AccessThis post details the integration of Cloudflare Access with Ping Identity (PingOne and PingFederate) to enforce Zero Trust security controls. It highlights how this integration enables strong authentication, SSO, and MFA for both modern and legacy applications without requiring application code modifications. The post also announces upcoming SCIM support for user and group synchronization.
  70. Cloudflare Aegis: dedicated IPs for Zero Trust migrationThis post introduces Cloudflare Aegis, a new capability that provides dedicated egress IP addresses for customers migrating to Zero Trust. Aegis allows organizations to lock down their services at an IP level, ensuring that traffic originates from a trusted, customer-specific IP range. This complements existing Zero Trust solutions like mTLS and Cloudflare Access by providing an additional layer of IP-based security, particularly beneficial for large organizations with many applications that are transitioning to Zero Trust models.
  71. Mutual TLS now available for WorkersIntroduces mTLS support for Cloudflare Workers, enabling Workers to authenticate to services that enforce mTLS connections. This is achieved by uploading client certificates and private keys via wrangler, configuring an mtls_certificates binding in wrangler.toml, and adding the mTLS binding to fetch() requests. Multiple certificates can be configured for per-request granularity, with a limit of 1,000 certificates per account.
  72. Using Cloudflare Access with CNIThis post introduces a new method for protecting hosted applications using Cloudflare Access in conjunction with Cloudflare Network Interconnect (CNI) and Aegis. This approach allows for Zero Trust policies to be enforced without requiring installed software or custom code on application servers. Aegis provides a dedicated, Cloudflare-sourced IP address for inbound traffic, enabling origin applications to enforce network-level firewall policies and ensure that only authenticated Access calls from Cloudflare can reach the application. This effectively air-gaps the service from direct public internet access, offering a more secure alternative to traditional VPNs and Cloudflare Tunnel for certain use cases.
  73. New Zero Trust navigation coming soon (and we need your feedback)This post announces an upcoming update to the Zero Trust dashboard navigation, scheduled for March 20, 2023. The changes aim to provide a more seamless user experience by enabling quicker navigation between Zero Trust and other Cloudflare products, easier account switching, and direct access to resources and support. The post also highlights underlying improvements in user and account authorization, the adoption of consistent table UIs, and a unified visual design for the Zero Trust dashboard to align with the broader Cloudflare experience. The motivation for this change stems from the growth of Zero Trust capabilities and the increasing use of multiple Cloudflare products together.
  74. Manage and control the use of dedicated egress IPs with Cloudflare Zero TrustIntroduced Gateway Egress policies within Cloudflare Zero Trust, allowing administrators to define rules for using dedicated egress IPs based on attributes like identity, application, IP address, and geolocation. This provides granular control over traffic egress, enabling specific use cases like geo-specific experiences and allowlisting third-party services without forcing all traffic through dedicated IPs.
  75. Inside Geo Key Manager v2: re-imagining access control for distributed systemsThis post introduces Geo Key Manager v2, a significant evolution in Cloudflare's access control capabilities. It details the challenges of Geo Key Manager v1, particularly its inflexibility in policy management and performance issues. The post highlights the adoption of Attribute-Based Encryption (ABE) as a solution, enabling more granular, flexible, and geographically-aware access control for sensitive data like TLS private keys. It also emphasizes ABE's potential to avoid centralized points of failure and includes the implementation in Cloudflare's open-source cryptographic library.
  76. Cloudflare incident on January 24, 2023This post details a significant incident on January 24, 2023, where a bug in the release of a service token feature led to widespread service degradation and unavailability for 121 minutes. The incident stemmed from an error in updating service token metadata, specifically overwriting the 'client_secret' with an empty string, which invalidated tokens for critical internal Cloudflare accounts. This impacted services like Workers, Zero Trust, WARP, Cache Purge, Cache Reserve, Images, and R2. The post explains the technical root cause, the incident timeline, the fix implemented through manual restoration and database backups, and the broader implications of service token management on platform authentication and stability.
  77. Cloudflare Zero Trust for managed service providersIntroduced parent-child policy configurations within the Tenant platform, integrating with Cloudflare Gateway. This enables MSPs to manage global corporate security policies at a parent account level and apply specific overrides or customizations at child account levels, facilitating scaled Zero Trust deployments for multi-tenant environments. Enhanced DNS location matching and filtering defaults for specific use cases like CISA's requirements for dedicated IPv4 resolvers and fail-closed behavior.
  78. Give us a ping. (Cloudflare) One ping only.This post introduces the integration of network diagnostic tools (ping, traceroute, MTR) into Cloudflare Zero Trust. It details how these tools leverage the ICMP protocol and are proxied over QUIC datagrams between Cloudflare and cloudflared instances. The post also provides examples of using these tools to troubleshoot connectivity to private network destinations behind Cloudflare Tunnel, highlighting the technical underpinnings and practical application for users managing private networks on Cloudflare.
  79. Announcing SCIM support for Cloudflare Access & GatewayIntroduced SCIM support for Cloudflare Access and Gateway, enabling automated user provisioning and deprovisioning from identity providers like Okta and Azure AD. This resolves challenges with manual deprovisioning, reducing security risks and administrative overhead. It also automates the synchronization of identity provider groups into Access and Gateway policies, simplifying policy creation and management, and allowing for forced reauthentication upon group membership changes.
  80. Cloudflare's CASB integration with Salesforce and BoxThis post announces the release of two new SaaS integrations for Cloudflare CASB: Salesforce and Box. This expands Cloudflare's CASB capabilities to identify and remediate security risks within these widely used platforms, addressing issues like insecure settings, inappropriate file sharing, and default permissions. This directly contributes to the evolution of securing SaaS applications and enhancing visibility into sensitive business data.
  81. Expanding our Microsoft collaboration: proactive and automated Zero Trust security for customersThis post announces four new integrations between Azure AD and Cloudflare Zero Trust: 1. Per-application conditional access, allowing enforcement of Azure AD Conditional Access policies within Cloudflare Access. 2. SCIM support for autonomous synchronization of Azure AD groups between Cloudflare Zero Trust and Azure AD, enabling automatic provisioning and deprovisioning of users and groups. 3. Risky user isolation, integrating Azure AD's risk signals to automatically isolate high-risk users via Cloudflare Browser Isolation. 4. Secure joint Government Cloud customers, enabling integration of Azure AD with Cloudflare Zero Trust for Government Cloud customers.
  82. Improved access controls: API access can now be selectively disabledCloudflare now allows account owners to selectively disable API access for specific users, enhancing granular control over API credentials. This feature, available for enterprise users, is a step towards account-owned API tokens and increased visibility of token usage, aiming to reduce the attack surface by enforcing the principle of least privilege.
  83. One-click data security for your internal and SaaS applicationsThis post introduces the integration of Cloudflare's browser isolation technology with its Zero Trust access control product. It details how this integration allows for controlling application usage and data by running sessions in an isolated browser environment within Cloudflare's network. Key features include disabling file downloads, printing, and copy-pasting, adding watermarks, enforcing read-only modes, and integrating with DLP. The solution is extended to SaaS applications via SSO integration.
  84. Network detection and settings profiles for the Cloudflare One agentIntroduced network detection for the Cloudflare One agent, enabling automatic switching between Cloudflare's network and local networks based on the user's physical location. This is achieved by defining managed networks using TLS certificate fingerprints and configuring device profiles that apply based on these network locations. Additionally, profiles can now be applied based on user group membership, allowing for more granular control over traffic routing for different user segments.
  85. New ways to troubleshoot Cloudflare Access 'blocked' messagesIntroduces enhanced troubleshooting for Cloudflare Access block messages, extending beyond identity-based rules to include connection context (location, IP, Secure Web Gateway presence). This is achieved via a GraphQL API for detailed request property lookup by RayID, User, or Application, and improved user-facing block pages with session details. The underlying analytics pipeline samples non-identity block logs to manage scale while retaining diagnostic data.
  86. Why do CIOs choose Cloudflare One?This post details the evolution of Cloudflare One as a comprehensive SASE offering, driven by customer feedback and the need to address enterprise connectivity and security challenges beyond traditional WAF and CDN. It highlights six key themes: more complete security, making teams faster, easier management, product integration, cost-efficiency, and single vendor capability. Specific technical advancements mentioned include the use of BoringTun (WireGuard implementation) for the Cloudflare agent, smart routing technology, and the integration of Area 1 Email Security. The post also provides customer examples illustrating the benefits of Cloudflare One for security and performance.
  87. Bring your own certificates to Cloudflare GatewayIntroduced support for customer-provided root certificates to Cloudflare Gateway, enabling organizations to use their own certificates for traffic inspection and policy enforcement (HTTP, DNS, CASB, DLP, RBI). This is achieved via API uploads of the root certificate and private key, followed by an account-level configuration update to enable the custom certificate. The feature allows for immediate propagation and zero-downtime transitions. This complements the existing option of using Cloudflare-provided certificates.
  88. Weave your own global, private, virtual Zero Trust network on Cloudflare with WARP-to-WARPIntroduced WARP-to-WARP connectivity, enabling direct private network connections between devices running Cloudflare WARP. This feature allows any WARP-enabled device within an organization to reach any other WARP-enabled device, facilitating use cases like developer testing, IT troubleshooting, and data synchronization between local and remote machines. Traffic is routed through Cloudflare's network, leveraging Argo Smart Routing and Zero Trust Secure Web Gateway for security and auditing, and can be upgraded from IP packets to proxied TLS connections.
  89. Cloudflare Zero Trust for Project Galileo and the Athenian ProjectThis post announces the availability of the Cloudflare One Zero Trust suite to organizations qualifying for Project Galileo and the Athenian Project at no cost. It details how Cloudflare One addresses common security challenges faced by these organizations, including phishing attacks (via Area 1 email security and DNS filtering), connecting employees and partners (via Cloudflare Tunnel and clientless access), and securing internet access (via Secure Web Gateway with malware scanning and DLP). It highlights that these enterprise-grade solutions can be configured and deployed quickly, even for organizations without dedicated IT departments.
  90. Democratizing access to Zero Trust with Project GalileoThis post announces the extension of Cloudflare's Zero Trust products to all domains under Project Galileo, aiming to democratize access to enterprise-level cybersecurity for underfunded organizations. It highlights how Project Galileo has evolved to address new threat environments and the digital divide in security, providing specific examples of how partners like CyberPeace Institute, ITDRC, Meedan, and the Organization of American States are leveraging Zero Trust tools for enhanced security and operational continuity.
  91. How Cloudflare uses Terraform to manage CloudflareThis post details Cloudflare's internal adoption and best practices for using the Cloudflare Terraform provider to manage its own account configurations. It highlights the benefits of code-driven management for security, auditability, and self-service, including the use of CI/CD pipelines (Atlantis), a monorepo structure for managing multiple accounts, encrypted state management, daily automated applies for drift detection and certificate rotation, and the introduction of API/Terraform read-only mode for Zero Trust configurations to enforce a single source of truth.
  92. Bringing authentication and identification to Workers through Mutual TLSIntroduces the upcoming feature of mutual TLS (mTLS) authentication for outbound requests from Cloudflare Workers. This allows Workers to present client certificates when making `fetch()` requests, enabling granular service-to-service authentication and identification. This addresses limitations of existing solutions like Authenticated Origin Pull (tied to public hostnames) and Token Authentication (cumbersome to manage, HTTP-based, doesn't expose client identity). The feature will allow origins to validate the client certificate and identify the specific Worker making the request.
  93. Gateway + CASB: alphabetti spaghetti that spells better SaaS securityThis post details the integration of Cloudflare Gateway and CASB, allowing for the automated creation of Gateway policies based on CASB-identified security findings in SaaS applications. It provides specific examples of how this integration can be used to block inappropriate file uploads, restrict oversharing, and prevent uploads to unapproved Shadow IT applications, thereby enhancing SaaS security.
  94. The (hardware) key to making phishing defense seamless with Cloudflare Zero Trust and YubicoThis post introduces an exclusive program for Cloudflare customers in collaboration with Yubico, offering YubiKeys at discounted pricing. It details how hardware security keys, using the WebAuthn standard, provide phishing-resistant authentication. The post explains how Cloudflare's Zero Trust platform, leveraging the Authentication Method Reference (AMR) standard, can enforce the use of hardware keys as a mandatory MFA factor, addressing the challenge of deploying physical keys at scale and improving security posture.
  95. How Cloudflare implemented hardware keys with FIDO2 and Zero Trust to prevent phishingThis post details the implementation of FIDO2/WebAuthn security keys as the sole MFA method for all Cloudflare employees, replacing TOTP and SMS. It describes the migration from a VPN-centric architecture to Cloudflare Zero Trust products, specifically Cloudflare Access, for enforcing phishing-resistant authentication. The post outlines the selective enforcement strategy using Terraform and OAuth2 AMR values, the benefits of RBAC integration, and the extension of security key authentication to SSH via Cloudflare Tunnel and cloudflared. It highlights the technical challenges and solutions in achieving a unified identity and access management approach.
  96. Now all customers can share access to their Cloudflare account with Role Based Access ControlsThis post announces the rollout of Role-Based Access Controls (RBAC) to all Cloudflare customers, including FREE and PAYGO plans. Previously, granular access control was limited to higher tiers. RBAC allows account owners to assign specific roles to users, granting them access only to designated parts of the Cloudflare offering (e.g., DNS, Firewall, Workers Admin). This enhances security by reducing the threat surface and preventing accidental misconfigurations. A comprehensive list of available roles and their associated permissions is provided.
  97. The first Zero Trust SIMIntroduced the Zero Trust SIM, a new capability that integrates SIM card technology with Cloudflare's Zero Trust platform. This involves leveraging SIMs (eSIM and physical) as a foundational element for mobile device security, enabling DNS filtering via Cloudflare Gateway, mitigating SIM-swapping attacks, and providing identity signals for secure private connectivity through Magic WAN. The SIM acts as an on-ramp to the Cloudflare One platform, simplifying BYOD security and offering a unified control plane for mobile traffic.
  98. Bringing Zero Trust to mobile network operatorsThis post introduces a new partnership program for mobile networks, 'Zero Trust for Mobile Operators,' to address security and performance challenges in 5G environments. It highlights the integration of Cloudflare One's SASE components (Magic WAN, Access, Gateway, CASB, Area 1) with mobile network infrastructure, emphasizing the complementary nature of their networks and services. The post also details the application of Cloudflare Workers for edge computing use cases within mobile networks, such as IoT, eCommerce, and financial data platforms, and introduces 'Workers for Platforms' as a mechanism for MNOs to offer edge compute to their customers. It further explores the network infrastructure synergy, enabling local breakouts and embedding Cloudflare services within MNO networks for reduced latency and enhanced security.
  99. Isolate browser-borne threats on any network with WAN-as-a-ServiceThis post introduces the integration of Cloudflare Browser Isolation with Magic WAN, allowing for the protection of Internet activity from browser-borne malware and zero-day threats on any network source (IPsec, GRE, Private Network connectivity). It details the configuration steps within the Zero Trust dashboard, including creating isolation policies and enabling non-identity on-ramp support. The post highlights how this combination displaces on-premise firewalls with cloud firewalls on Cloudflare's global network, addressing latency and scale constraints of legacy approaches.
  100. Cloudflare Data Loss Prevention now Generally AvailableThis post announces the General Availability of Cloudflare's Data Loss Prevention (DLP) product. It details what DLP is, how it works by inspecting HTTP traffic for sensitive data patterns (like PII, credit card numbers, and SSNs) using regex and algorithms, and how it can be configured and applied via HTTP policies within the Zero Trust Dashboard. The post also highlights DLP's integration with other Cloudflare Zero Trust services for a comprehensive data protection strategy.
  101. Detect security issues in your SaaS apps with Cloudflare CASBIntroduced Cloudflare CASB (Cloud Access Security Broker) as a new addition to the Zero Trust platform. CASB connects to and scans third-party SaaS applications (initially Google Workspace, Microsoft 365, Slack, and GitHub) to identify security issues such as data exposure, file oversharing, misconfigurations, insecure settings, and Shadow IT. It leverages vendor APIs to provide visibility into data-at-rest and access permissions, complementing existing Zero Trust solutions like Cloudflare Access and Gateway.
  102. Improved Access Control: Domain Scoped Roles are now generally availableIntroduced Domain Scoped Roles and Domain Groups, allowing user access to be scoped to individual domains or groups of domains. This enhances security by enforcing the principle of least privilege and reduces administrative toil by automating access management for groups of domains. The feature is rolling out to Enterprise Cloudflare accounts and represents a step forward in migrating to a new authorization system built for Cloudflare's scale.
  103. The mechanics of a sophisticated phishing scam and how we stopped itThis post details a sophisticated phishing attack targeting Cloudflare employees, which was thwarted by the mandatory use of FIDO2 security keys and Cloudflare One products. The attack involved targeted SMS messages leading to a fake Okta login page, designed to steal credentials and Time-based One-Time Password (TOTP) codes. Cloudflare's response included blocking the phishing domain via Cloudflare Gateway, resetting credentials for affected employees, taking down attacker infrastructure (hosted on DigitalOcean and using Mullvad VPN), updating threat detections, and auditing service access logs. Lessons learned led to further enhancements in Cloudflare Gateway, browser isolation for risky sites, and stricter access controls for VPNs and proxies.
  104. Live-patching security vulnerabilities inside the Linux kernel with eBPF Linux Security ModuleThis post introduces the use of eBPF LSM to implement a security policy that prevents unauthorized user namespace creation via the `unshare` syscall. This directly addresses a privilege escalation vulnerability and demonstrates how Cloudflare leverages advanced kernel features to enhance security, aligning with the broader theme of zero-trust and robust access control.
  105. Cloudflare One vs Zscaler Zero Trust Exchange: who is most feature complete? It’s not who you might expectThis post positions Cloudflare One as a superior Zero Trust solution compared to Zscaler Zero Trust Exchange. It highlights Cloudflare's advantages in terms of its internet-native network platform, cloud-native service platform, broader adoption of SASE services, and extensive network on-ramps. Specific technical advantages discussed include a single, global Anycast network versus Zscaler's multiple distinct clouds, leading to a unified administrator experience and consistent service availability. Performance is also emphasized, with Cloudflare One demonstrating significantly higher throughput (6 Gbps) compared to Zscaler's 1 Gbps limit for GRE tunnels, enabling better support for high-bandwidth applications. Furthermore, Cloudflare's extensive interconnection peers and virtual backbone are presented as superior to Zscaler's edge-focused approach, enabling better transit and connectivity beyond the initial on-ramp.
  106. How Cloudflare Security does Zero TrustThis post details Cloudflare's internal implementation of Zero Trust principles, focusing on the evolution from legacy VPNs to Cloudflare Access, Gateway, and the integration of Area 1 Email Security. It highlights the use of FIDO2 security keys for enhanced authentication, the deployment of DNS filtering and HTTP filtering for office and remote users, and the implementation of Remote Browser Isolation. The post also mentions the upcoming integration of CASB functionality.
  107. Kubectl with Cloudflare Zero TrustThis post details the implementation of Cloudflare Zero Trust for securing Kubernetes API access, enabling kubectl usage without proxies. It describes the transition from VPN-based access to Cloudflare Tunnels and then to private network routing via the Zero Trust agent. The post provides Terraform configurations for creating Argo Tunnels and routes, setting up Cloudflare Gateway rules to bypass HTTP inspection for Kubernetes API traffic, and deploying tunnel endpoints as Kubernetes pods. It highlights the benefits of simplified onboarding and improved developer velocity.
  108. Decommissioning your VDIThis post introduces Remote Browser Isolation (RBI) as a viable alternative to Virtual Desktop Infrastructure (VDI) for securing access to internal web applications. It details the challenges of VDI (high costs, poor user experience, complexity) and explains how RBI, specifically Cloudflare Browser Isolation, addresses these by running browser sessions on Cloudflare's global network. It highlights the benefits of RBI, including improved user experience through Network Vector Rendering (NVR), simplified administration, and lower, more predictable costs compared to VDI. A customer story from PensionBee illustrates the successful adoption of RBI to secure access to Salesforce.
  109. Connect to private network services with Browser IsolationIntroduced Browser Isolation with private network connectivity, enabling users to access private web services via isolated remote browsers. This feature integrates Cloudflare Access for authorization and Cloudflare Tunnels for secure connectivity, eliminating the need for endpoint software or virtual desktops. It allows for granular policy definition, data protection controls (clipboard, printing, file upload/download), and logging through the Secure Web Gateway.
  110. Announcing Gateway + CASBIntroduces the integration of API-driven Cloud Access Security Broker (CASB) with Secure Web Gateway. This integration allows users to create Gateway policies directly from CASB security findings, enabling rapid remediation of security issues within SaaS applications. For example, a CASB finding about unauthorized third-party apps in Google Workspace can be used to create a Gateway policy to block specific activities like uploads or downloads to that application.
  111. A stronger bridge to Zero TrustThis post announces enhancements to the Cloudflare One platform, focusing on making the migration from legacy network architectures to Zero Trust easier. Key contributions include: 1. Enhanced interoperability between various on-ramps (BYOIP, WARP client, CNI, GRE tunnel, IPsec tunnel) and off-ramps (Cloudflare Tunnel), enabling a fully composable and interoperable Zero Trust network. 2. Expanded support for additional IPsec configuration parameters, a new UI for managing Anycast IPsec and GRE tunnels, and Terraform provider support for network-as-code management. 3. Improved on-ramp integration with SD-WAN appliances, including new integration guides for devices like Cisco Viptela.
  112. Using Cloudflare Tunnel and Access with PostgresThis post details the implementation of Cloudflare Tunnel and Cloudflare Access to provide secure, identity-driven access to internal PostgreSQL databases, replacing the previous SSH bastion host method. It describes the setup of Cloudflare Tunnel within Kubernetes to connect to the database clusters and the configuration of Cloudflare Access policies for authentication and authorization. The post also highlights the client-side setup using `cloudflared access` for users to connect to local ports, effectively tunneling traffic to the remote database. Granular access control for staging and production databases is achieved through independent Tunnels. A 'break glass' procedure using SSH jump-hosts for senior staff is maintained for emergency access.
  113. Cloudflare integrates with Microsoft Intune to give CISOs secure control across devices, applications, and corporate networksThis post details the integration of Cloudflare Zero Trust (Access and Gateway) with Microsoft Endpoint Manager (Intune). It explains how joint customers can leverage Microsoft Graph API to obtain real-time device posture assessments, such as compliance state, and use this data to build conditional access policies within Cloudflare. The integration allows for device management profiles to be checked, and access granted accordingly, enhancing security by ensuring devices meet defined compliance criteria before granting access to internal or external applications.
  114. Cloudflare Gateway dedicated egress and egress policiesIntroduces dedicated egress IPs for Cloudflare Gateway, allowing administrators to assign dedicated source IPs (IPv4 and IPv6) for egress traffic. This feature enables granular allowlisting policies based on identity, application, network, and geolocation attributes, addressing the need for static source IPs in legacy systems and facilitating the deprecation of VPNs. An upcoming egress IP policy builder in the Zero Trust dashboard will provide further flexibility in routing specific traffic through dedicated egress IPs.
  115. Verify Apple devices with no installed softwareThis post introduces the integration of Private Access Tokens (PATs) into Cloudflare Access. This allows for the verification of device health (e.g., OS version, jailbreak status) for Apple devices without requiring any client software installation. It leverages the Privacy Pass Protocol and works in conjunction with device manufacturers (Attester) and Cloudflare (Issuer) to provide anonymous, unforgeable tokens for access control decisions, enhancing Zero Trust security.
  116. Introducing Private Network DiscoveryIntroduced Private Network Discovery, a Zero Trust network discovery tool that passively catalogs resources and users accessing them without additional configuration. This tool helps organizations gain visibility into their private networks, enabling them to translate discovered traffic into Cloudflare Access applications and security policies. The feature works by connecting private networks via Cloudflare Tunnel and users via the Cloudflare WARP agent, then surfacing origins (IP, port, protocol) for review and application creation. The initial beta allows for friendly application names and tracks origin status ('Unreviewed', 'In-Review'). Future general availability will enable direct creation of Access applications from the report and integration into the Zero Trust policy builder.
  117. Infinitely extensible Access policiesIntroduced 'External Evaluation' rules for Cloudflare Access policies, allowing integration with any API to define custom access criteria beyond identity, device, and location. This enables dynamic policy evaluation based on external signals, such as mTLS certificate verification against a registry via a Worker API. The feature provides a secure mechanism for extending Access policies with custom business logic and integrates with existing identity providers and user information.
  118. Launching In-Line Data Loss PreventionIntroduces Data Loss Prevention (DLP) as a native part of the Cloudflare One platform. DLP profiles are added to the Zero Trust dashboard, allowing users to define sensitive data using keywords and regexes. Cloudflare provides pre-built profiles for common detections. These profiles are then used in Cloudflare Gateway HTTP policies to scan traffic and allow or block sensitive data from leaving the organization. This extends Zero Trust's data protection by identifying data based on its characteristics, complementing existing identity, device posture, content category, and application configuration identifiers.
  119. Zero Trust, SASE and SSE: foundational concepts for your next-generation networkThis post introduces and defines Zero Trust, Secure Access Service Edge (SASE), and Security Service Edge (SSE) as foundational concepts for next-generation enterprise network architecture. It details the components of SASE, including secure access functions (ZTNA, SWG, RBI, CASB, DLP), on-ramps, and the service edge, and positions Cloudflare One as a comprehensive SASE platform that delivers these capabilities.
  120. Building many private virtual networks through Cloudflare Zero TrustThis post introduces the capability to create multiple segregated virtual private networks over Cloudflare Zero Trust, specifically for Cloudflare WARP and Cloudflare Tunnel. This addresses the long-standing problem of overlapping IP address spaces (CIDRs) in enterprise networks, which previously prevented the setup of distinct private networks with identical IP ranges. The solution allows for logical segregation of these networks, enabling users to select specific virtual networks for routing traffic, thus overcoming the limitations of a single, unified private network.
  121. CVE-2022-1096: How Cloudflare Zero Trust provides protection from zero day browser vulnerabilitiesThis post details how Cloudflare Zero Trust, specifically its browser isolation service, provides proactive protection against zero-day browser vulnerabilities like CVE-2022-1096. It explains the layered defense strategy involving traffic steering, secure web gateway inspection, and remote browser execution. The remote browser isolation service executes all website code in a physically isolated remote browser, destroying and reconstructing them after each session. This approach protects unpatched devices and aids security incident response teams by logging egress traffic. The post highlights the advantage of automatically patching remote browsers on Cloudflare's network, contrasting it with the challenges of patching user-managed local browsers.
  122. Cloudflare’s investigation of the January 2022 Okta compromiseThis post details Cloudflare's investigation and response to the Okta compromise, focusing on how their internal security incident response team (SIRT) reacted to a potential breach affecting their employee identity provider. It outlines the timeline of actions taken, including immediate incident room creation, log analysis (Okta system logs and Google Workplace email logs), account suspension, and forced password resets for affected employees. The post also reiterates Cloudflare's use of Okta for internal employee authentication, integrated with Cloudflare Access and hardware tokens (FIDO), and emphasizes that Okta is not used for customer authentication. It provides recommendations for Okta customers to enhance their security posture, including enabling MFA and investigating suspicious events.
  123. Zero Trust for SaaS: Deploying mTLS on custom hostnamesThis post introduces the ability for SaaS providers to enable mutual TLS (mTLS) authentication on their customers' domains through Cloudflare Access. This extends the zero-trust security model to scenarios where SaaS providers manage origins for domains they do not own, allowing them to enforce device-level authentication for sensitive API endpoints and provide per-customer isolation.
  124. Domain Scoped Roles - Early AccessIntroduced Domain Scoped Roles and Domain Groups for more granular user access management within enterprise accounts. This is powered by a new permission system called Bach, which allows for policy-based authorization with resource scoping, moving beyond the legacy role-based system. Bach enables finer-grained permissions and resource scoping, allowing for more explicit control over what actions users can perform on specific resources like domains.
  125. Securing Cloudflare Using CloudflareThis post details the implementation of Cloudflare Access policies to enforce FIDO2 security keys as the sole second factor for accessing internal and external applications. It demonstrates how Terraform is used to manage Access policies, specifically enforcing the 'swk' (software-secured key) authentication method via the 'amr' field in OIDC provider responses. The post highlights the significant improvement in security posture by reducing soft token usage to near zero after this enforcement.
  126. Using Cloudflare One to Secure IoT devicesThis post details how Cloudflare One can be used to secure IoT devices by tunneling their traffic via Anycast GRE to the Cloudflare Global network, allowing for egress rules to be configured from the Cloudflare dashboard to prevent lateral movement. This provides a serverless, infrastructure-less solution for isolating IoT devices without requiring them to be on a separate network or VLAN, offering automatic logging and single-point configuration.
  127. Zero Trust client sessionsIntroduces Zero Trust client-based sessions, allowing for periodic reauthentication for TCP connections and UDP flows, enhancing Zero Trust Network Access (ZTNA) by addressing the risk of persistent sessions on lost/stolen or shared devices. The feature allows administrators to configure reauthentication frequency based on resource sensitivity. Beta feedback led to improvements in the intrusiveness of authentication pop-ups and plans for direct client authentication.
  128. Introducing SSH command loggingIntroduces SSH command logging as a new capability within Cloudflare Zero Trust, extending the Secure Web Gateway to inspect and log SSH traffic. This provides network-layer visibility into SSH sessions, including commands run across multiple jump-hosts, without requiring software installation on individual machines. Logs are encrypted with customer-provided public keys, and a FIPS 140-2 mode is available. User authentication is handled via Cloudflare Short-Lived Certificates, eliminating manual SSH key management.
  129. Cloudflare partners with Microsoft to protect joint customers with a Global Zero Trust NetworkThis post details the integration of Cloudflare Access with Azure Active Directory (Azure AD) to provide centralized identity and access management for both Azure-hosted and on-premise applications. It highlights how Cloudflare Access acts as a VPN replacement and a secure on-ramp to Cloudflare's global network, enforcing security checks for every user accessing every resource. The integration leverages Azure AD's SSO, MFA, and Conditional Access policies, and can be combined with Cloudflare Tunnel for enhanced security without exposing applications to the public internet. It also announces Cloudflare's partnership with Azure AD for secure hybrid access to legacy on-premise applications, enabling seamless integration without significant code changes.
  130. A bridge to Zero TrustIntroduces the ability to route traffic from WARP-enrolled devices to networks connected via IP-layer tunnels (GRE, IPsec, CNI). This enables private network access for TCP/UDP applications and provides a bridge from traditional VPN architecture to Zero Trust, allowing for gradual transitions. Leverages a new internal service called Hermes for sharing WARP session location data across the network to facilitate return traffic routing.
  131. Managing Clouds - Cloudflare CASB and our not so secret plan for what’s nextThis post announces the upcoming expansion of Cloudflare CASB with new integrations (Google Workspace, GitHub, Zoom, Slack, Okta, Microsoft 365, Salesforce), SaaS asset management for unified visibility across applications, and remediation guides with automated workflows for issue resolution. It also highlights the integration of CASB with Cloudflare Gateway for Shadow IT discovery and management. The beta program is opening for sign-ups, focusing on Google Workspace and GitHub integrations initially.
  132. Clientless Web Isolation is now generally availableCloudflare announces the general availability of Clientless Web Isolation, a new on-ramp for Browser Isolation that natively integrates Zero Trust Network Access (ZTNA) with remote browsing benefits. This feature allows users to access any website, internal app, or SaaS application from any device without installing software or configuring certificates on the endpoint. It supports deep linking into isolated browsing sessions, integration with third-party secure web gateways, and secure access on BYOD devices, simplifying BYOD support compared to traditional VDI.
  133. Cloudflare and CrowdStrike partner to give CISOs secure control across devices, applications, and corporate networksThis post details the integration of Cloudflare Zero Trust services with CrowdStrike's Endpoint Detection and Response (EDR) and Zero Trust Assessment (ZTA). Joint customers can now build Access and Gateway policies based on CrowdStrike's real-time device posture assessments (ZTA scores). This enables conditional access based on device health and compliance checks, allowing organizations to enforce minimum ZTA scores or versions before granting access. The integration allows for policies to invoke Browser Isolation, tenant control, antivirus, and other Cloudflare Zero Trust features. Setup involves configuring CrowdStrike as a device posture provider in the Cloudflare Zero Trust dashboard using ClientID, Client Secret, REST API URL, and Customer ID. Future work includes correlating Cloudflare logs with Falcon telemetry.
  134. Cloudflare acquires Vectrix to expand Zero Trust SaaS securityCloudflare acquires Vectrix to expand Zero Trust SaaS security. Vectrix provides an API-driven Cloud Access Security Broker (CASB) to detect security issues across SaaS applications, focusing on data security, user activity, misconfigurations, compliance, and shadow IT. The integration will extend Cloudflare Zero Trust platform capabilities, enabling unified management of SaaS security alongside existing ZTNA, SWG, and Browser Isolation services. Setup is described as easy via OAuth 2.0 or marketplace apps, operating out-of-band without network slowdowns.
  135. Adding a CASB to Cloudflare Zero TrustThis post announces the acquisition of Vectrix, a CASB company, and its integration into the Cloudflare Zero Trust platform. It details how CASB functionality complements existing Zero Trust capabilities like Cloudflare Access and Gateway, focusing on controlling data and configurations within SaaS applications. The post outlines the evolution of Zero Trust from defending internal resources to protecting users on the public internet and now, managing data within SaaS applications. Vectrix's technology scans SaaS applications for configuration anomalies, permissions issues, and sharing risks, providing a unified control and audit point.
  136. Version and Stage Configuration Changes with HTTP Applications in BetaThis post introduces HTTP Applications and Routing Rules, a significant evolution in how customers manage edge configurations. It addresses the limitations of the traditional 'Zone' model by enabling versioned configurations for specific use cases, independent of hostnames. The introduction of staging and production routing rules allows for safe, staged testing and deployment of changes to Cloudflare's global edge network, directly mitigating issues of manual configuration copying, configuration drift, and the risk of outages during updates.
  137. All the Platform Improvements We’ve Made in 2021 to Make CIOs Lives EasierIntroduced Zone Scoped Roles beta, allowing granular access control to specific zones within an account, differentiating between production and testing/staging environments. This enhances security by limiting edit access to critical production zones to authorized personnel while allowing broader read-only access for investigations. Also highlighted improvements to SSO onboarding by leveraging SaaS Applications in Cloudflare Access for a streamlined setup process within the Cloudflare for Teams dashboard.
  138. Secure how your servers connect to the Internet todayThis post details how Cloudflare One's network firewall and DNS filtering capabilities can be used to secure outbound traffic from servers, directly addressing the risks exposed by the Log4j vulnerability. It introduces the concept of applying layered security controls, including DNS filtering, network firewalling (layers 3-5), and Secure Web Gateway (HTTP inspection), to protect infrastructure from both inbound and outbound threats. The post emphasizes the ease of deployment and the ability to create positive security models by allowing only specific destinations.
  139. Cloudflare One helps optimize user connectivity to Microsoft 365This post announces Cloudflare's participation in the Microsoft 365 Networking Partner Program (NPP) and highlights how Cloudflare One optimizes user connectivity to Microsoft 365. It details the benefits of using Cloudflare's global network for direct and fast access to Microsoft 365 services, while simultaneously applying zero-trust security measures to other internet traffic. The post also explains how Cloudflare One can identify and secure SaaS application usage, providing visibility into Shadow IT and enabling administrators to enforce policies for data protection.
  140. Cloudflare announces integrations with MDM companiesAnnounces new integrations with MDM vendors (Microsoft Intune, Ivanti, JumpCloud, Kandji, and Hexnode) to streamline the deployment and installation of the Cloudflare WARP agent. Provides detailed command-line deployment scenarios for Windows, including options for HTTP filtering, browser isolation, device posture, service tokens, and disabling the initial client UI. Highlights the importance of MDM solutions for managing distributed device fleets and enhancing security posture.
  141. Cloudflare Agent — Seamless Deployment at ScaleThis post announces significant advancements in the Cloudflare WARP agent, a core component of Cloudflare for Teams' zero-trust offering. Key contributions include achieving feature parity across all major platforms (Windows, macOS, ChromeOS, Linux, iOS, Android), enhancing deployment scalability with Rust-based shared daemon and BoringTun for reliable connections, and introducing flexible traffic routing options like domain-based and include-only split tunneling. It also highlights API and Terraform integration for automated deployment and configuration, and previews upcoming features like posture-only mode and user/group-specific settings.
  142. Introducing Clientless Web IsolationIntroduces clientless web isolation as a new on-ramp for Browser Isolation, integrating Zero Trust Network Access (ZTNA) with remote browsing benefits. This allows users on any device to access internal apps or SaaS applications without installing software or configuring certificates on the endpoint. It works by using HTML5 to establish a low-latency connection to a remote browser hosted in a Cloudflare data center after authentication via an identity provider. High-risk links can be prefixed to automatically route traffic through the isolated browser, protecting the endpoint from malicious code. This feature augments ZTNA use cases by allowing applications protected by Access and Gateway to leverage Browser Isolation's data protection controls, such as clipboard and file transfer restrictions.
  143. Extending Cloudflare’s Zero Trust platform to support UDP and Internal DNSThis post introduces early access to UDP support and Internal DNS resolution within Cloudflare's Zero Trust platform. It details how Cloudflare Tunnel and WARP are extended to handle UDP traffic, enabling use cases like internal DNS resolvers and thick client applications, thereby providing a more complete alternative to traditional VPNs. The post also outlines the steps for connecting networks and users to this enhanced platform.
  144. Zero Trust Private Networking RulesIntroduced session control and login interval enforcement for Zero Trust private network access, allowing administrators to configure specific session durations and require re-authentication with multi-factor authentication. Also added UDP support for private network access, enabling the use of existing private DNS nameservers to map application hostnames on local domains.
  145. Announcing Anycast IPsec: a new on-ramp to Cloudflare OneThis post introduces IPsec as a new network-layer on-ramp to Cloudflare One. It addresses the need for a universally supported and encrypted method to connect private networks to Cloudflare's global network, overcoming the limitations of traditional hub-and-spoke and mesh IPsec architectures. The implementation leverages Cloudflare's Anycast network and internal technologies like Cloudflare Tunnels to provide a scalable, resilient, and easier-to-manage IPsec solution integrated with the broader Cloudflare One suite.
  146. Cloudflare One: One Year LaterThis post marks one year of Cloudflare One, highlighting its evolution into a comprehensive Zero Trust platform. It details the growth in traffic defended (5x), applications protected (over 192,000), and adoption by small teams. New features announced include IPsec Tunnels, improvements to Cloudflare Tunnel, network firewall features, and network performance acceleration. The post emphasizes the composable traffic filtering stack, identity-driven controls, and the integration of security with performance.
  147. PII and Selective Logging controls for Cloudflare’s Zero Trust platformIntroduced role-based dashboard access for logging and analytics pages, allowing granular control over who can view PII. Also added selective logging of events for DNS, Network, and HTTP components, with options to capture all, capture only blocked, or don't capture. This allows administrators to control the level of logging stored by Cloudflare, with the option to use Logpush for external storage.
  148. Welcome to CIO Week and the future of corporate networksThis post introduces Cloudflare One as a comprehensive Zero Trust Network-as-a-Service (NaaS) platform, marking a significant evolution in how Cloudflare addresses corporate network challenges. It contrasts traditional 'castle-and-moat' and 'smörgåsbord of point solutions' architectures with Cloudflare's vision for the future of corporate networks. The post details the shortcomings of legacy approaches, including security gaps, performance issues, high costs, and lack of agility, and positions Cloudflare One as the solution to these problems by enabling next-generation networks on Cloudflare's infrastructure.
  149. Cloudflare for SaaS for All, now Generally Available!This post announces the general availability of Cloudflare for SaaS, a product designed to help SaaS providers offer fast, secure, and scalable infrastructure to their customers. It details the components of Cloudflare for SaaS, including Workers, SSL for SaaS, custom hostnames, WAF, Bot Management, and the global Anycast network. The post also highlights flexible, usage-based pricing for custom hostnames and showcases examples of companies (mmm.page, Lightfunnels, Ventrata) successfully using the platform, particularly leveraging Cloudflare Workers for performance and custom hostnames for domain and SSL management.
  150. Tunnel: Cloudflare’s Newest HomeownerThis post introduces Cloudflare Tunnel, a new capability that securely connects infrastructure to Cloudflare without opening firewall holes. It significantly enhances the management of these tunnels through a new UI in the Cloudflare for Teams Dashboard, providing visibility into status, routes, uptime, connectors, and `cloudflared` versions. The post details improvements to the onboarding experience with interactive guides and introduces management features for tunnel routes, connectors, and `cloudflared` replicas, all contributing to a more robust zero-trust security offering.
  151. Announcing Access Temporary AuthenticationIntroduces Temporary Authentication for Cloudflare Access, allowing security administrators to grant temporary access to applications based on approvals from predefined administrators. This feature extends 'Purpose Justification' by adding scoped permissions and a second approval requirement, sending access requests to a list of approvers who can approve, deny, or grant access for a set duration. Built using Cloudflare Workers, it enables low-latency access requests and reviews, and allows for flexible application of temporary access based on context like device or location.
  152. Cloudflare for OfficesThis post introduces 'Cloudflare for Offices,' a new offering that extends Cloudflare's network and Zero Trust capabilities directly into office buildings. It simplifies branch office connectivity by eliminating legacy hardware like MPLS links, WANs, and VPNs, and provides a direct onramp to Cloudflare One. This enhances security posture, improves performance by bringing the edge closer to users within their workspaces, and offers a more flexible and cost-effective alternative to traditional office network infrastructure, aligning with the broader evolution of Cloudflare's Zero Trust and network access management solutions.
  153. The Zero Trust platform built for speedThis post details how Cloudflare for Teams builds upon the company's global network and serverless platform (Workers) to deliver a performant Zero Trust solution. It explains how Cloudflare Tunnel, Argo Smart Routing, and the global network backbone accelerate application access. It also highlights how Cloudflare Access leverages Workers for instant Zero Trust decisions, and how Cloudflare Gateway uses the same infrastructure as 1.1.1.1 for fast DNS filtering. The Secure Web Gateway is also presented as a performance-enhancing security layer.
  154. What’s new with Cloudflare for SaaS?This post announces significant enhancements to Cloudflare for SaaS and SSL for SaaS for Enterprise customers. Key additions include Apex Proxying to allow customers to use their zone apex with Cloudflare, Bring Your Own IPs (BYOIP) for greater IP allocation control, custom origin support to route different customers to different origins, wildcard support for custom hostnames to cover subdomains, CSR support and custom cert uploads for flexible TLS certificate management, and custom metadata with Workers for per-hostname configuration. The post also teases upcoming analytics features for customer traffic visibility.
  155. Data protection controls with Cloudflare Browser IsolationIntroduces Cloudflare Browser Isolation's data protection controls, allowing administrators to define Zero Trust policies to control copy, paste, and print functionality within web-based applications. This feature shifts the risk of executing untrusted website code to a secure remote browser hosted on Cloudflare's edge, offering a balance between security and performance by sending lightweight vector instructions rather than pixels. Administrators can configure these controls per-rule with granular control based on application, hostname, user identity, and security risk.
  156. Announcing Tenant Control in Cloudflare GatewayIntroduces Tenant Control in Cloudflare Gateway, allowing organizations to enforce rules ensuring employees can only log in to corporate instances of applications and that corporate data stays within corporate accounts. This is achieved by deploying the WARP agent and applying HTTP filtering rules that append specific headers (e.g., tenant ID for Microsoft 365, X-GooGApps-Allowed-Domains for GSuite) to requests, which the SaaS application uses to enforce tenant restrictions. This provides a more granular control over SaaS application usage than traditional DNS filtering and avoids the performance implications of legacy backhauling approaches.
  157. Zero Trust controls for your SaaS applicationsCloudflare Access now supports securing SaaS applications by injecting Zero Trust checks into the SAML SSO flow. This is achieved using Cloudflare Workers to convert JWTs into SAML assertions, allowing for identity-aware and context-driven rules (device posture, MFA, country of login) to be applied to SaaS applications. This enables centralized logging and consistent security controls across self-hosted and SaaS applications, with guided integrations for AWS, Zendesk, and Salesforce.
  158. Capturing Purpose Justification in Cloudflare AccessIntroduced a new feature in Cloudflare Access that prompts users to enter a justification for accessing an application prior to login. This feature allows administrators to log and review these justifications, add additional security layers to sensitive applications, customize modal text, and help meet regulatory requirements for data access control. The functionality is configurable per Access policy and integrates with existing audit logs.
  159. 6 New Ways to Validate Device PostureThis post introduces six new device posture types for Cloudflare for Teams: Application Check, File Check, Disk Encryption, OS Version, Firewall, and Domain Joined. These new checks, along with existing ones like Endpoint Protection Partners, Serial Number, WARP proxy status, and Secure Web Gateway status, allow administrators to build more granular Zero Trust rules based on the security posture of connecting devices. The post details how to configure these new attributes and groups within the Cloudflare for Teams dashboard and apply them to Access policies.
  160. Introducing Shadow IT DiscoveryIntroduces Shadow IT Discovery, a feature within Cloudflare for Teams Gateway that detects and categorizes unapproved SaaS applications used by an organization. It operates in an observation mode, allowing administrators to review and designate applications as approved or unapproved. The feature also provides insights into user counts for applications, aiding in license management and cost optimization. It integrates with Cloudflare Access to highlight applications already secured by the platform.
  161. Browser VNC with Zero Trust RulesIntroduces Browser VNC, a new capability that renders a VNC client entirely in the browser, eliminating the need for client-side software installation. This is achieved by leveraging Cloudflare Workers for edge rendering and Cloudflare Tunnel for secure, low-latency TCP connections to VNC servers. Cloudflare Access is used for Zero Trust authentication and authorization, ensuring only verified users can connect. Future enhancements will include full auditability of user actions within VNC sessions.
  162. Announcing WARP for Linux and Proxy ModeThis post announces the expansion of Cloudflare WARP to Linux and introduces a new 'proxy mode' for all desktop platforms. WARP for Linux brings the secure and fast internet experience to a new operating system, leveraging a shared Rust codebase for cross-platform consistency. The proxy mode allows users to selectively route application traffic through WARP, offering more granular control than the previous all-or-nothing approach, and complements existing Cloudflare for Teams features like Secure Web Gateway.
  163. Introducing Zero Trust Private NetworkingIntroduces identity-aware, Zero Trust network policies enforced at the Cloudflare edge for traffic within private networks. This allows for network filtering and logging based on user identity, group, device, or network, replacing traditional IP-based rules and VPNs. It leverages cloudflared for secure tunnels and WARP for client-side traffic forwarding, enabling granular control over access to private IP addresses and ports based on identity policies.
  164. Network-based policies in Cloudflare GatewayIntroduced network-based policies in Cloudflare Gateway, allowing administrators to control access to any network origin (IP address and port) for all TCP traffic. This extends Zero Trust controls beyond DNS and HTTP to non-HTTP protocols like SSH. Policies can be identity-based, applying to specific users or groups, and integrate with the WARP agent and Cloudflare One for comprehensive network security and replacement of legacy firewalls.
  165. Highly available and highly scalable Cloudflare tunnelsThis post introduces the ability to run multiple instances of `cloudflared` for a single Cloudflare Tunnel. This significantly enhances the reliability and scalability of tunnels by enabling graceful restarts, elastic auto-scaling, and easier integration with container orchestration platforms like Kubernetes. It addresses a key user request for scaling `cloudflared` to match the scalability of other system components.
  166. SSHing to my Raspberry Pi 400 from a browser, with Cloudflare Tunnel and Auditable TerminalThis post details the practical application of Cloudflare Tunnel and Auditable Terminal to securely access a Raspberry Pi 400 from a browser, without opening firewall ports. It highlights the integration of Cloudflare for Teams for authentication and access control, demonstrating a real-world use case for zero-trust access to internal resources.
  167. Start building your own private network on Cloudflare todayThis post introduces the ability to create private networks on Cloudflare's global edge, extending Zero Trust controls to non-web applications. It details the architecture involving Cloudflare Tunnel (`cloudflared` connector) and WARP agent for seamless connectivity to private IPs. The solution aims to replace traditional VPNs by offering IP-level connectivity and Zero Trust controls for applications like RDP and SSH, with future plans for identity-based network-level rules.
  168. A Boring Announcement: Free Tunnels for EveryoneThis post announces the renaming of Argo Tunnel to Cloudflare Tunnel and makes its core functionality—secure, outbound-only connections—free for everyone. It details the evolution of Tunnel from a solution for connecting origins to Cloudflare without public IPs, to enhancing security by enforcing Zero Trust policies and eliminating inbound firewall rules. Key improvements highlighted include enhanced stability through removal of internal dependencies and migration to Cloudflare's edge load balancer (Unimog), and increased persistence with the introduction of Named Tunnels. The post also provides examples of how to use Tunnel for connecting applications and building private networks.
  169. A Zero Trust terminal in your web browserThis post introduces a browser-based terminal for accessing non-HTTP resources like SSH, enabling Zero Trust controls, session auditing, and accelerated user experience without client-side configuration. It addresses challenges in securing and delivering applications outside the browser by rendering a fully functional console within the user's browser, authenticated via SSO and subject to Zero Trust rules. The platform supports SSH use cases initially, with plans to expand to other application types, and includes features for data transfer control and future session recording.
  170. Build Zero Trust rules with managed devicesIntroduces the ability to build Zero Trust access rules based on managed device status, leveraging the WARP client and a list of corporate device serial numbers. This allows organizations to restrict access to applications to only corporate-owned devices, even without a dedicated MDM platform.
  171. Inside Cloudflare: Preventing Account TakeoversThis post details how Cloudflare's Security Team uses Cloudflare products (Gateway, Access, WAF) and internal engineering to prevent account takeovers on their own applications. It highlights the use of FIDO2 hardware security tokens, managed corporate devices, and machine learning models for detecting anomalous authentication behavior. It also discusses the importance of blocking malicious domains via Gateway and enforcing granular access policies via Access to mitigate various account takeover techniques like credential stuffing, phishing, and SIM-swapping.
  172. Announcing Cloudflare’s Data Loss Prevention platformIntroduced Cloudflare's Data Loss Prevention (DLP) platform as part of Cloudflare One. This platform enables Zero Trust controls over enterprise data by performing inline inspection of all traffic, capturing DNS queries and file uploads/downloads for audit trails, and integrating with the Secure Web Gateway. It allows for the enforcement of Role-Based Access Controls (RBAC) across applications, even those without native RBAC support, and provides control over file upload/download policies. The Web Application Firewall (WAF) now includes DLP features to scan and block sensitive data in application responses. Future plans include applying DLP rules to data sets within any application and scanning all outbound traffic without performance degradation.
  173. Using Cloudflare for Data Loss PreventionThis post details how Cloudflare's existing account access management and security tools, specifically Cloudflare Access, Gateway, and Browser Isolation, can be leveraged for Data Loss Prevention (DLP). It highlights the importance of addressing both internal and external threats, including accidental breaches and compromised accounts, by implementing granular access controls, securing endpoints, and protecting APIs. The post emphasizes the role of Zero Trust principles in preventing data exfiltration and improving incident response.
  174. New device security partnerships for Cloudflare OneThis post introduces new integrations with VMware Carbon Black, CrowdStrike, and SentinelOne for Cloudflare for Teams, augmenting the existing Tanium integration. These integrations allow Cloudflare Access policies to leverage device security signals from endpoint security vendors. For Tanium, this involves inputting a certificate and enabling Endpoint Identity. For CrowdStrike, VMware Carbon Black, and SentinelOne, it requires the WARP client to be deployed and configuration within the Teams Dashboard's 'Device posture' tab. Access policies can then be built using these device posture signals to grant or deny access to applications, ensuring devices are company-sanctioned and free of malware.
  175. The Teams Dashboard: The Design StoryThis post details the design story behind the Cloudflare for Teams dashboard, focusing on the integration of Access and Gateway functionalities. It highlights the evolution from initial concepts to an MVP, the challenges of merging existing security technologies into a unified experience, and the design considerations for scale and future growth. The narrative emphasizes collaboration between Product, Design, and Engineering to create a comprehensive security platform.
  176. Control web applications with two-clicks in Cloudflare GatewayIntroduced the ability to create Gateway HTTP rules based on 'Applications' and 'App Types'. Applications are collections of hostnames associated with a specific cloud application (e.g., Salesforce, Microsoft Office 365), while App Types are collections of applications (e.g., File Sharing, Social Media). This significantly reduces the manual effort required by IT administrators to manage firewall policies for cloud applications by allowing them to apply rules to entire applications or categories of applications with a single rule, rather than managing individual hostnames. Cloudflare will maintain and update these collections.
  177. The Teams Dashboard: Behind the ScenesThis post details the redesign of the Cloudflare for Teams Dashboard, focusing on improving the user experience and simplifying the onboarding process. It highlights the 'duplex problem' of siloed functionality between Access and Gateway and introduces a new unified onboarding flow and 'Quick Start' guide with 'Starter Packs' to address this. The design philosophy emphasizes leading with design and asking 'why' to ensure intentionality and user-centric solutions.
  178. Integrating Cloudflare Gateway and AccessThis post introduces the integration of Cloudflare Gateway and Cloudflare Access, allowing Access policies to require that all user traffic to an application be filtered by Gateway. This ensures that all traffic to self-hosted and SaaS applications is secured and centrally logged. It addresses challenges related to device security before application connection, data leakage, and compromised credentials by leveraging Gateway's threat filtering, file upload/download controls, and content category filtering. The integration allows for rules that restrict connections to devices running Gateway and enforces data control rules within SaaS applications by integrating Access into the login flow, preventing access without Gateway protection.
  179. Configure identity-based policies in Cloudflare GatewayThis post introduces identity-based policies for Cloudflare Gateway, allowing administrators to create fine-grained rules based on user identity attributes (username, email, group name/email, group ID) integrated with Cloudflare Access. It also enables user-level filtering of HTTP traffic logs for auditing and security incident investigations. Additionally, it details the integration with Cloudflare Isolated Browser for enhanced security against zero-day attacks.
  180. Announcing Workplace Records for Cloudflare for TeamsIntroduces Workplace Records, a new feature for Cloudflare for Teams that leverages Access and Gateway logs to determine the country from which employees are working. This feature helps finance, legal, and HR departments meet payroll tax obligations and provides a record for compliance. It allows for country-specific rules within Access groups and provides per-user country login data, with plans for a company-wide report and integration with HCM/HRIS/HRMS/Payroll providers.
  181. Many services, one cloudflaredThis post introduces a major enhancement to Argo Tunnel by enabling a single instance of `cloudflared` to proxy an unlimited number of services. This is achieved through the introduction of 'Named Tunnels' and a new 'ingress rules' configuration system. These features allow users to define how traffic is routed from the Cloudflare edge to specific local services based on hostname and path, significantly reducing resource consumption and management overhead for customers with large deployments. It also introduces validation tools for ingress rules and per-rule configuration options for origin requests.
  182. One more (Zero Trust) thing: Cloudflare Intrusion Detection SystemThis post announces Cloudflare Intrusion Detection System (IDS), a new product that monitors network traffic for suspicious behavior. IDS integrates with Cloudflare One (WARP and Magic Transit) to provide a comprehensive view of network traffic. It operates by analyzing traffic shape (behavioral anomalies) and traffic inspection (content analysis) to detect threats that static firewall rules might miss. IDS leverages global threat intelligence and allows for one-click blocking of detected intrusions.
  183. How our network powers Cloudflare OneThis post introduces Cloudflare One as a unified approach to enterprise networking and security, directly leveraging Cloudflare's existing global network infrastructure. It details how the network's distribution (data centers in over 200 cities, 100 countries, 42 Tbps capacity), scalability (every product on every server, commodity hardware, software-based functions), connectivity (8,800+ network interconnections, CNI, private backbone), and insight (attack intelligence, smart routing) are fundamental to delivering Cloudflare One's value proposition to organizations. It highlights how Cloudflare One extends these network advantages to protect and manage enterprise data centers, offices, and devices.
  184. Introducing Magic FirewallIntroduces Magic Firewall, a network-level firewall delivered as a service on Cloudflare's global network. It aims to replace on-premises firewall appliances by providing scalable, edge-based network filtering. The initial version supports static Layer 3 & 4 mitigations with self-service rule configuration using Wireshark syntax, allowing for granular control over protocol, IP, port, packet length, and bit field matches. It integrates with Cloudflare One and Magic Transit, enabling consistent policy application across devices, branch offices, and data centers. Future capabilities will include traffic type-based policies and intrusion detection.
  185. How small businesses can start using Cloudflare One todayThis post details how small businesses can start using Cloudflare One, a network-as-a-service solution, by implementing DNS Filtering, WARP+ for secure remote worker connections, Cloudflare Access to replace VPNs, and a Secure Web Gateway for threat and data loss prevention. It highlights the availability of a free plan for up to 50 users, making Zero Trust security accessible to smaller organizations. The post provides step-by-step instructions and links to relevant documentation for deploying these features.
  186. Introducing Cloudflare Browser Isolation betaThis post introduces Cloudflare Browser Isolation as a beta feature, representing a new approach to secure web browsing. It addresses the inherent risks of web browsers by running them in sandboxed, remote environments within Cloudflare's global network. This complements existing Cloudflare for Teams offerings like Cloudflare Access and Gateway by providing a solution for unknown and unforeseeable threats, effectively extending the zero-trust perimeter to the browser itself and improving the user experience compared to traditional browser isolation methods.
  187. Introducing WARP for Desktop and Cloudflare for TeamsThis post introduces the general availability of Cloudflare WARP for desktop users and its integration with Cloudflare Gateway for enterprise security teams. It details how the WARP client, powered by BoringTun (Cloudflare's WireGuard implementation), encrypts all device traffic and routes it to Cloudflare's edge. For businesses, WARP integrates with Cloudflare Gateway to enforce web filtering and security policies for remote workers without backhauling traffic. Key features highlighted include end-to-end encryption, WARP+ speed benefits, user-based policies, and device/user auditing capabilities. Deployment options for organizations are also outlined.
  188. Cloudflare Gateway now protects teams, wherever they areThis post introduces L7 filtering for Cloudflare Gateway, enabling inspection and policy enforcement on HTTP traffic based on URL, path, query string, HTTP method, response code, file type, MIME type, and security/content category. It also details the integration with the Cloudflare WARP desktop client for distributed workforce protection and outlines future plans for L4 filtering (IP, port, protocol) and identity-based policies integrated with Cloudflare Access.
  189. Zero Trust For EveryoneThis post announces the launch of Cloudflare for Teams Free plan, which provides Zero Trust security features for up to 50 users at no cost. It details the two core components: Cloudflare Access (securing inbound connections) and Cloudflare Gateway (securing outbound connections). The post highlights the mission-driven approach to making Zero Trust accessible to all organizations, regardless of size, and provides examples of how users can leverage the Free plan for startup collaboration, home network security, personal website protection, and guest Wi-Fi safeguarding. It also introduces enhanced features in standalone Access and Gateway plans, and a bundled Teams Standard plan.
  190. Cloudflare Access: now for SaaS apps, tooThis post introduces the capability for Cloudflare Access to protect SaaS applications by integrating with SAML identity providers. It details the use of JWTs generated from aggregated identity signals (SSO, country, device posture) and their conversion to SAML assertions using Cloudflare Workers. This enables consistent security and visibility for SaaS applications that were previously outside Cloudflare's reverse proxy network.
  191. Introducing Cloudflare OneThis post introduces Cloudflare One, a comprehensive SASE solution that integrates Cloudflare's network services with leading identity management (Okta, Ping Identity, OneLogin) and device integrity (CrowdStrike, VMware Carbon Black, SentinelOne, Tanium) providers. It marks a significant evolution in Cloudflare's zero-trust networking strategy, moving beyond traditional network security to a unified platform for secure, optimized global networking, replacing legacy appliance-based approaches with a cloud-native solution.
  192. What is Cloudflare One?This post introduces Cloudflare One, a comprehensive vision for corporate security and networking that integrates existing and new products like WARP, Gateway, Magic Transit, Magic Firewall, and Cloudflare Access. It explicitly positions Cloudflare One as a solution to the challenges of modern enterprise networking and security, moving beyond the traditional perimeter model to a Zero Trust architecture. It highlights the combination of networking and security controls, flexible data planes, and a unified control plane for managing traffic, identity, and security policies.
  193. What Happens When The Whole World Goes Remote? Not To Worry, We Were Built For ThisThis post details a customer's successful migration of internally-hosted applications to Cloudflare Access to support a sudden shift to a fully remote workforce. It highlights the ease of use and rapid deployment of Cloudflare Access in a critical situation, enabling secure access for hundreds of users without overwhelming existing VPN infrastructure. The customer's prior use of Cloudflare for external-facing security products (WAF, CDN, Zone lockdown) facilitated their adoption of Access for internal applications.
  194. Two clicks to add region-based Zero Trust complianceIntroduced country-based access rules to Cloudflare Access policies. Administrators can now create rules to 'Require' users to connect from specific countries or 'Exclude' users connecting from certain countries. These rules can be combined with existing identity provider and other Zero Trust signals to enforce region-specific compliance requirements.
  195. Improving the Wrangler Startup ExperienceThis post introduces `wrangler login`, a new authentication flow for the Wrangler CLI tool that simplifies the developer experience for Cloudflare Workers. It replaces the manual API token creation process with a direct Cloudflare login, leveraging a secure token transfer mechanism with asymmetric RSA encryption to protect user credentials. This significantly improves the initial setup and onboarding for developers using Cloudflare's serverless platform.
  196. Require hard key auth with Cloudflare AccessThis post details the implementation of a new rule in Cloudflare Access that allows administrators to enforce specific Multi-Factor Authentication (MFA) methods, such as hardware security keys (WebAuthn, FIDO2, Touch ID, Windows Hello), for accessing protected resources. This is achieved by leveraging the 'amr' (Authentication Method Reference) field within the JSON Web Token (JWT) generated by the identity provider and passed to Cloudflare Access. The system now checks this field to ensure that only users who authenticated with the required MFA method are granted access, preventing fallback to less secure methods like TOTP or SMS.
  197. Protecting Remote Desktops at Scale with Cloudflare AccessIntroduced Argo Tunnel RDP Bastion mode, which allows a single cloudflared instance to proxy requests to any internal server, simplifying deployment for large fleets of RDP servers. This eliminates the need to install cloudflared on each individual RDP server, reducing deployment headaches and enabling organizations to protect hundreds of remote desktops through a single tunnel gated by Cloudflare Access.
  198. Tanium’s endpoint security meets Cloudflare for TeamsThis post details the integration of Tanium's endpoint management platform with Cloudflare Access. Administrators can now configure Cloudflare Access policies to require that users authenticate with their identity provider AND connect from a healthy, Tanium-monitored device. This adds a device posture check as a second layer of assurance for accessing corporate resources, complementing user identity checks. The integration involves adding Tanium's public certificate to Cloudflare for Teams and configuring device posture rules within Cloudflare Access policies.
  199. Releasing Cloudflare Access’ most requested featureThis post introduces the ability to configure identity options on individual applications within Cloudflare Access. Previously, all configured SSO providers were displayed for every application. Now, administrators can select specific applications in the Cloudflare for Teams UI and toggle individual providers on or off for that application. If only one provider is enabled for an application, users will be directly redirected to that provider, skipping the SSO selection page. This addresses the scalability issue of listing all providers for every app, especially in organizations with distributed and mixed workforces.
  200. Resolve internal hostnames with Cloudflare for TeamsIntroduced domain override functionality within Cloudflare Gateway. This feature allows administrators to configure rules that redirect traffic destined for specific hostnames to alternative IP addresses, enabling seamless access to internal resources while maintaining security for public internet traffic. This complements existing secure DNS filtering and facilitates the transition to zero-trust architectures by allowing organizations to manage internal and external traffic routing through a single platform.
  201. DeepLinks and ScrollAnchorThis post introduces and details the implementation of 'DeepLinks' and 'ScrollAnchor' within the Cloudflare Dashboard. It explains how deep linking enhances user experience by allowing direct navigation to specific resources, improving troubleshooting documentation, and enabling dynamic resolution of account and zone contexts. The post also describes the 'ScrollAnchor' component for scrolling to specific content on a page, and the underlying resolver mechanism that handles dynamic value resolution and user interaction when necessary.
  202. Setting up Cloudflare for Teams as a Start-Up BusinessThis post details how the acquired S2 Systems team integrated their Remote Browser Isolation (RBI) platform with Cloudflare Access and Gateway. It highlights the challenges of manually managing identity providers for early adopters and the significant time savings achieved by using Cloudflare Access for securing the RBI service and marketing pages. It also describes the implementation of Cloudflare Gateway for office network security and the use of `cloudflared` tunnels with Access to connect developers to remote development machines, demonstrating a comprehensive adoption of Cloudflare for Teams for startup security needs.
  203. A single dashboard for Cloudflare for TeamsThis post details the migration of the Cloudflare Access UI into the Cloudflare for Teams dashboard. It explains the previous UI's confusion stemming from conflating account-level settings (SSO, logs) with site-specific rules. The new dashboard separates these concerns, providing a clearer user experience and a foundation for future integrated features between Access and Gateway. The core functionality of Access (replacing VPNs with zero-trust policies, using Argo Tunnel) remains the same, but its management interface has been significantly improved.
  204. Releasing kubectl support in AccessThis post introduces support for securing Kubernetes clusters managed by kubectl using Cloudflare Access and Argo Tunnel. It details the architecture for connecting clusters to Cloudflare via `cloudflared` and establishing client connections through a SOCKS proxy, enabling SSO requirements and a zero-trust model for Kubernetes management without disrupting existing kubectl workflows. It also highlights lessons learned from dogfooding the feature internally.
  205. Deploying Gateway using a Raspberry Pi, DNS over HTTPS and Pi-holeThis post details the deployment of Cloudflare Gateway for home networks using a Raspberry Pi, Pi-hole, and DNS over HTTPS (DoH). It highlights how Gateway can be used by individuals and small businesses to protect their devices and networks from security threats, extending the reach of Cloudflare for Teams beyond traditional corporate environments. The post provides a technical walkthrough of setting up Gateway on a Raspberry Pi with Pi-hole and dnscrypt-proxy, and also explains how to configure DoH in browsers like Firefox and Chromium-based browsers.
  206. Time-Based One-Time Passwords for Phone SupportThis post introduces Time-Based One-Time Passwords (TOTP) for Enterprise customer phone support. It details how customers can generate single-use tokens from the Cloudflare dashboard or use a 2FA app to authenticate themselves over the phone, enhancing account security and enabling greater support without relying solely on support tickets. The post also explains the underlying TOTP mechanism (RFC 6238) and Cloudflare's specific implementation for both dashboard-generated tokens and authenticator app integration, including a mechanism to validate tokens from the previous time step to account for network delays.
  207. Cloudflare now supports security keys with Web Authentication (WebAuthn)!This post introduces support for WebAuthn security keys as a two-factor authentication (2FA) method for Cloudflare user accounts. It explains the WebAuthn protocol, its advantages over other 2FA methods (SIM swapping, TOTP) in terms of phishing resistance and user experience, and its privacy guarantees. The post also notes that SSO-authenticated users will not have access to this 2FA method as their SSO provider manages it.
  208. Dogfooding from Home: How Cloudflare Built our Cloud VPN ReplacementThis post details the internal development of Cloudflare Access (formerly EdgeAuth) as a replacement for traditional hardware-based VPNs. It highlights the motivation for building Access, driven by the need for a more performant, secure, and globally distributed authentication solution for internal applications. Key technical aspects discussed include L7 policy enforcement, support for non-HTTP services like Git, and the benefits of a zero-trust model for granular access control and auditing. The post emphasizes the 'dogfooding' culture at Cloudflare, where internal needs drive product development.
  209. Migrating from VPN to AccessThis post details Cloudflare's migration from a traditional VPN-based security model to a zero-trust architecture using Cloudflare Access. It highlights the challenges of VPN maintenance and scaling, and the introduction of SSH support over Access to secure source control systems. The post also describes the use of Cloudflare Spectrum to protect the existing VPN infrastructure during the transition period, addressing MTU issues for UDP-based VPN traffic and achieving an MTU of 1420. The migration has led to new employees no longer requiring VPN setup.
  210. Using Cloudflare to secure your cardholder data environmentThis post announces the expansion of Cloudflare's PCI compliance scope to include Content Delivery Network (CDN), Cloudflare Access, and the Cloudflare Time Service. It details how these services help customers meet PCI DSS requirements, specifically mentioning WAF for requirement 6.6, Access for segmentation and requirement 8.1.8 (session timeouts), and Time Service for accurate audit logging (requirement 10.4.3). It also highlights the availability of TLS 1.3, exceeding requirement 4.1.
  211. Using Cloudflare Gateway to Stay Productive (and turn off distractions) While Working RemotelyThis post introduces Cloudflare Gateway as a tool for users to block distracting websites and improve productivity while working remotely. It details the setup process, including configuring locations, changing router DNS settings to use Cloudflare Gateway's resolvers, and creating policies to block specific domains or content categories. It also explains how to test the blocking functionality using DNS lookups and browser redirects.
  212. Open sourcing our Sentry SSO pluginThis post details the development and open-sourcing of a JWT-based SSO plugin for Sentry, enabling Cloudflare Access to authenticate users directly into Sentry without requiring a second login. It explains the JWT security model used by Cloudflare Access and provides guidance on building similar plugins for other applications.
  213. How Replicated Developers Develop RemotelyThis post details Replicated's implementation of a remote development environment strategy using Cloudflare Access and Argo Tunnel. Key technical contributions include: 1. Migrating from local Docker-based Kubernetes development to cloud-hosted Google Cloud instances. 2. Utilizing `cloudflared` to establish secure HTTP/2 tunnels to Cloudflare data centers, eliminating the need for public IPs or open ports on developer instances. 3. Implementing BeyondCorp-style authentication via Cloudflare Access, allowing developers to log in with their existing Google credentials and enabling instant revocation of access. 4. Leveraging VS Code's Remote SSH extension to provide a seamless local development experience on remote machines, with port forwarding configured via `.ssh/config`. 5. Integrating `skaffold` for managing Kubernetes deployments within the remote development environment. The post also outlines a 'How To' guide for replicating this setup.
  214. How Cloudflare keeps employees productive from any locationThis post details the internal use of Cloudflare Access to replace corporate VPNs, focusing on its application for browser-based tools (Jira, Confluence via SSO plugin), SSH connections (leveraging Argo Tunnel and cloudflared), and an App Launch feature for streamlined onboarding. It highlights the security benefits of per-request logging and the technical implementation of Argo Tunnel for outbound-only connections. The post also mentions the free offering of Cloudflare for Teams during the COVID-19 emergency.
  215. Introducing Secrets and Environment Variables to Cloudflare WorkersIntroduced Secrets and Environment Variables for Cloudflare Workers. Secrets are encrypted upon saving and never visible to users, addressing high-stakes use cases like API keys. Environment Variables are stored in plain text for simpler configuration. Both are accessible via the Wrangler CLI and Workers Dashboard. The feature was designed based on user research and usability testing, leading to adjustments in terminology (e.g., 'KV namespace binding') and UI separation of KV bindings from other environment variables.
  216. Seamless remote work with Cloudflare for TeamsThis post introduces Cloudflare for Teams, highlighting Cloudflare Access as a solution to replace corporate VPNs for remote work. It details how Access secures self-hosted applications and internal tools by enforcing identity-based policies, replacing traditional castle-and-moat security models with a zero-trust approach. The post emphasizes seamless user experience, device flexibility (including mobile), and support for remote development workflows like SSH and RDP. It also introduces Argo Tunnel for secure outbound connections and an application launchpad for improved user discoverability and onboarding. The Replicated case study demonstrates the practical application of Cloudflare Access for secure remote development environments.
  217. Using your devices as the key to your appsThis post details the implementation of mutual TLS (mTLS) authentication with Cloudflare Access. It covers generating a Root CA using `cfssl`, configuring it in Cloudflare Access, and creating an Access policy to enforce client certificate validation. The process of generating a client certificate and converting it to PKCS #12 format for iPhone deployment is also described, enabling device-based authentication for a prototype web application.
  218. Multi-SSO and Cloudflare Access: Adding LinkedIn and GitHub TeamsThis post introduces the integration of LinkedIn and GitHub Teams as new login methods for Cloudflare Access, expanding its Multi-SSO capabilities. It details the challenges of managing external user identities and how Cloudflare Access addresses them by allowing simultaneous integration with multiple identity providers. The post highlights the benefits of seamless onboarding for contractors, friction-free mergers and acquisitions, and zero-downtime SSO migrations. It also explains how Cloudflare Access generates standardized JWTs from various identity providers for application authorization and introduces the Access App Launch feature for a unified application view.
  219. Announcing the Cloudflare Access App LaunchThis post introduces the Access App Launch portal, a new feature for Cloudflare Access. This portal acts as a dashboard for end-users, displaying all applications protected by Access. Once enabled, users can log in and access these applications with a single click. The portal leverages existing Access policies to dynamically generate a personalized view for each user, eliminating the need for manual configuration of application lists. It also enhances defense-in-depth against phishing attacks by providing a trusted entry point for internal applications.
  220. Helping mitigate the Citrix NetScaler CVE with Cloudflare AccessThis post details how Cloudflare Access can be used to mitigate a specific Citrix NetScaler CVE by acting as an identity proxy for the administrator portal. It explains that by placing the login page behind Cloudflare Access, unauthenticated users are prevented from reaching the vulnerable interface. The post also mentions the integration with Argo Tunnel for secure outbound connections and the potential to bundle Access with the Cloudflare WAF for layered security.
  221. Introducing Cloudflare for TeamsThis post introduces Cloudflare for Teams, a suite of tools designed to address the 'other half' of IT security challenges: securing internal users and their access to resources. It launches two core products: Cloudflare Access, described as a 'modern VPN' for fast, secure access to internal resources, and Cloudflare Gateway, a 'modern Next Generation Firewall' for protection against malware and policy enforcement. Both products are built on Cloudflare's global network, leveraging its scale, reliability, and threat intelligence. Access is presented as an alternative to traditional VPNs and the 'castle and moat' security model, aligning with the Zero Trust principles inspired by Google's BeyondCorp. Gateway builds upon the 1.1.1.1 DNS resolver and WARP/WARP+ products. The post emphasizes competitive pricing and partnerships with security, SIEM, and identity providers.
  222. Security on the Internet with Cloudflare for TeamsThis post introduces Cloudflare for Teams, a new platform that extends Cloudflare's network and security capabilities to protect teams, devices, and data. It consists of two products: Cloudflare Access and Cloudflare Gateway. Cloudflare Access replaces corporate VPNs by securing internally managed applications through identity-based policies enforced at the edge. It leverages Argo Tunnel for secure outbound connections and integrates with identity providers for seamless SSO. Cloudflare Gateway aims to protect users from threats on the Internet. The post details the legacy problems of corporate security (securing internal applications, threats on the Internet, and securing data) and how Cloudflare for Teams addresses them by applying Cloudflare's global network and learnings to the team and data security challenges.
  223. Log every request to corporate apps, no code changes requiredThis post introduces per-request logging for Cloudflare Access, enabling detailed audit trails of all user requests to applications secured by the gateway. Previously, logging only captured initial authentication events. The new feature allows for the export of request headers, including user identity (via `cf-access-user`), to SIEMs or S3 buckets via Cloudflare Logpush. This provides a comprehensive view of user sessions, aiding in security investigations and compliance.
  224. Public keys are not enough for SSH securityThis post introduces the integration of short-lived certificates for SSH authentication within Cloudflare Access. It details how Cloudflare Access, Argo Tunnel, and Workers are used together to replace static SSH keys and traditional network perimeter security. The solution involves the `cloudflared` CLI tool on both client and server sides, generating JWTs upon SSO authentication, which are then used to obtain ephemeral certificates from a Cloudflare signing endpoint. These certificates authenticate the user to the target server, enabling zero-trust SSH access.
  225. Terraforming Cloudflare: in quest of the optimal setupThis post introduces the adoption of Infrastructure-as-Code (IaC) practices for managing Cloudflare configurations, specifically focusing on access rules, zone settings, and account members. It details the use of Terraform and Terragrunt to achieve declarative, version-controlled management, enabling modularity, reusability, and dynamic resource creation through static, parameterized, and dynamic resource implementations. This significantly enhances the manageability and consistency of Cloudflare's account access and permissions across multiple domains and environments.
  226. Talk Transcript: How Cloudflare Thinks About SecurityThis post details Cloudflare's internal approach to security, emphasizing a strong reporting culture, the use of HackerOne for external vulnerability disclosure, and the development of internal identity and authentication solutions like Cloudflare Access. It highlights the transition from a chaotic system of multiple logins to a unified, secure access control mechanism, including the rollout of Yubikeys and TOTP for all employees. The post also touches on the importance of transparency in security incidents (like Cloudbleed) and the shift towards memory-safe languages (Go and Rust) in software development.
  227. Announcing the General Availability of API TokensThis post introduces the general availability of API Tokens, a new feature that allows for more secure and scalable interaction with the Cloudflare API. API Tokens enable scoping by Cloudflare resource (accounts and zones) and by permission, adhering to the principle of least privilege. The post details how to create and use these tokens, including examples with templates and curl requests, and highlights their integration with existing tools like the Terraform provider and Cloudflare-Go library. It also recommends migrating from Global API Keys to API Tokens for enhanced security.
  228. Securing infrastructure at scale with Cloudflare AccessIntroduced wildcard subdomain support for Cloudflare Access policies, allowing a single policy to secure all subdomains of a given domain. This significantly reduces the administrative overhead of managing access policies for a large number of internal applications and servers, particularly in dynamic environments like dev/staging or for SSH access to a fleet of servers. The feature enables administrators to create a policy for "*.example.com" and have it automatically apply to any generated subdomain, simplifying the process of securing infrastructure at scale.
  229. A Tale of Two (APT) TransportsThis post introduces a new custom APT transport that integrates with Cloudflare Access to secure private APT repositories. It details the history of APT, the bootstrapping problem of installing HTTPS support, and the mechanism by which APT transports work. The post outlines the installation of the `cloudflared` executable and the custom `cfd` APT transport binary, and demonstrates how to configure APT sources to use the `cfd://` scheme. It also covers fetching GPG keys over Access and discusses handling Access on headless servers.
  230. Announcing the New Cloudflare Partner PlatformThis post introduces Cloudflare's new partner platform, detailing its architecture based on 'Tenants' and 'Subscriptions'. It describes the process of provisioning customer accounts via the API (POST /accounts), granting customer access using existing member APIs (POST /accounts/{id}/members), and enabling services by creating zones and attaching zone subscriptions. The IBM partnership is highlighted as a key driver and early adopter for the development of this platform, which was built to address the limitations of the previous partner platform and support newer products like Argo and Workers.
  231. Cloudflare Access now supports RDPThis post introduces the integration of Remote Desktop Protocol (RDP) support into Cloudflare Access. It addresses security vulnerabilities associated with RDP, such as weak passwords and open ports, by leveraging identity provider integration for stronger authentication and Argo Tunnel to secure connections without exposing the RDP port (3389). The post details the configuration steps using `cloudflared` for both protecting RDP machines and connecting to them, emphasizing the use of SSO credentials for RDP sessions.
  232. Give your automated services credentials with Access service tokensIntroduced Access service tokens, a new feature for Cloudflare Access that provides credentials (Client ID and Secret) to automated tools, scripts, and bots. This allows these services to authenticate with Cloudflare Access without redirecting to an identity provider, enabling secure access to internal sites and applications for machine-to-machine communication. Service tokens are scoped to a specific service and can be added to Access policies to grant granular permissions. The Client ID and Secret are valid for one year and can be rotated or revoked.
  233. Banking-Grade Credential Stuffing: The Futility of Partial Password ValidationThis post critically analyzes the security flaws of partial password validation, a common practice in account access management. It demonstrates how this method is ineffective against credential stuffing attacks and poses usability challenges for password manager users. The post strongly advocates for the adoption of multi-factor authentication (MFA) as a superior security measure, highlighting TOTP and hardware tokens as preferred alternatives to less secure methods like SMS OTP.
  234. OAuth Auth Server through WorkersThis post details an implementation of an OAuth 2.0 Authentication server using Cloudflare Workers and Cloudflare Storage. It outlines the steps involved in the OAuth 2.0 workflow, including user redirection, code generation, and token exchange. The implementation leverages Workers for stateless logic and KV storage for session management, codes, and tokens. It also demonstrates the use of JWT for token signing and verification, and discusses the integration with external services and the potential for using Cloudflare Access for simpler use cases.
  235. Announcing SSH Access through CloudflareIntroduced SSH access through Cloudflare Access, enabling secure connections to internal applications like source control repositories. This was achieved by leveraging Argo Tunnel for secure connections, Argo smart routing for performance acceleration, and the `cloudflared` CLI tool for establishing the connection between the user's device and the target server. The flow involves redirecting users to their identity provider for authentication, generating a JWT, and transferring it to `cloudflared` for subsequent requests.
  236. Introducing Single Sign-On for the Cloudflare DashboardIntroduced Single Sign-On (SSO) for the Cloudflare dashboard for Enterprise customers. This allows customers to use their existing identity providers (e.g., G Suite via SAML) to authenticate users accessing the dashboard. A Cloudflare Worker was developed to translate Access authentication tokens to the dashboard's internal authentication tokens, running at the edge to reduce latency.
  237. Leave your VPN and cURL secure APIs with Cloudflare AccessIntroduced `cloudflared`, a CLI tool that enables command-line authentication for Cloudflare Access. This allows users to securely access APIs and sensitive data via tools like `curl` by obtaining and injecting a JWT into requests, effectively replacing the need for VPNs for command-line tasks. This extends Access control policies to API endpoints and CLI operations.
  238. Cloudflare Access: Sharing our single-sign on plugin for AtlassianThis post introduces a new plugin for Atlassian tools (Jira and Confluence) that enables single sign-on (SSO) by leveraging JWTs issued by Cloudflare Access. The plugin maps identity data from the JWT payload to existing Atlassian user accounts, allowing users to access these tools with a single login. The post also details the structure and usage of JWTs in Cloudflare Access and announces efforts to expand JWT-based authorization to other applications.
  239. Three new ways teams are using Cloudflare AccessIntroduced One-Time Pin (OTP) as a login method for external partners, allowing access to internal applications without requiring them to be added to the primary Identity Provider (IdP). This involves configuring OTP alongside an existing IdP (e.g., Okta) and creating Access Groups to manage external user email addresses. Also detailed how to create policies that require both IdP authentication and origin from specific network IP ranges for enhanced security.
  240. Cloudflare Access: Now teams of any size can turn off their VPNThis post announces the general availability of Cloudflare Access, a zero-trust solution designed to replace VPNs. It details the core functionality of Access, which controls who can reach internal resources by checking policies before requests reach the origin. Key features introduced or highlighted include integration with identity providers (GSuite, Okta), policy enforcement based on user authentication, IP addresses, and the introduction of 'Access Groups' for managing sets of users. New policy types like 'Bypass' for specific paths and 'Everyone' for broader access are also described. The post also outlines the pricing structure for Access Basic and Access Premium plans.
  241. Expanding Multi-User Access on dash.cloudflare.comIntroduced multi-user access for all customers, allowing account administrators to invite others to manage their account with full control except for member management and billing changes. For customers with multiple accounts, an account selector was added for easier navigation. Enterprise customers gained Administrator and Billing Roles in addition to existing roles. The dashboard migrated to dash.cloudflare.com, supporting only TLS 1.2+, and was rewritten from Backbone to React, with an overhauled mobile browsing experience. The backend data model for account and user management was decoupled, separating users from accounts to enable this expansion and improve architectural clarity for distributed teams.
  242. Getting started with Terraform and Cloudflare (Part 1 of 2)This post introduces the integration of Terraform with Cloudflare, enabling infrastructure as code for managing Cloudflare configurations. It details how developers can use Terraform to programmatically manage DNS records, zone settings, rate limiting, load balancing, and page rules, moving configuration management from manual UI interactions to version-controlled code. This significantly enhances account management by allowing for automated deployments, change tracking, and rollbacks, aligning with best practices in software development.
  243. Now You Can Setup Centrify, OneLogin, Ping and Other Identity Providers with Cloudflare AccessThis post introduces support for Centrify, OneLogin, and generic OIDC-based identity providers within Cloudflare Access. It provides detailed technical steps for configuring these integrations, including setting up applications in Centrify and OneLogin, and configuring client ID, client secret, auth URL, token URL, and certificate URL for generic OIDC providers. This expands the identity provider integration options for Cloudflare Access beyond existing GSuite, Okta, and Azure AD.
  244. How Developers got Password Security so WrongThis post delves into the historical and ongoing challenges of password security, highlighting insecure storage practices and weak user-generated passwords. It explains cryptographic hashing, salting, and the limitations of these methods against modern cracking techniques and credential stuffing. The post advocates for improved developer education, the elimination of password reuse through mechanisms like range search APIs for breached password databases, and the broader adoption of two-factor authentication (2FA) as a critical security layer.
  245. Keeping our users safeThis post highlights the critical importance of account security and the prevalent threat of credential theft and phishing attacks, even in 2018. It details how attackers exploit weak credentials and password reuse, and showcases sophisticated attack vectors like malicious browser extensions that steal API keys. Cloudflare's response includes enhancing its backend security with strong password hashing (bcrypt) and API key generation (AES, SHA256), robust logging and auditing, and secure transit over HTTPS. For user interface protection, it emphasizes the necessity of strong passwords and 2FA, and introduces IP-based alerts and MFA codes for higher-tier accounts. Furthermore, it announces immediate improvements to API key security, such as CAPTCHA protection for viewing API keys, and outlines future plans for scoped API keys and IP restrictions.
  246. Introducing Cloudflare Access: Like BeyondCorp, But You Don’t Have To Be A Google Employee To Use ItIntroduced Cloudflare Access, a perimeter-less access control solution for cloud and on-premise applications. Access acts as a reverse proxy that enforces access control by ensuring every request is authenticated (integrating with identity providers like Google, Azure AD, Okta, and supporting TLS with client authentication), authorized (configuring access policies for groups and users), and encrypted (leveraging HTTPS instead of VPN). Features include easy policy changes, session duration modification, session revocation, and centralized logging. It can be paired with Argo and Argo Tunnel for enhanced performance and security, and integrated with the Web Application Firewall for legacy application protection.
  247. Introducing TLS with Client AuthenticationIntroduced TLS with Client Authentication for enterprise customers, enabling server-side authentication of clients via unique client certificates. This feature offloads CPU-intensive cryptographic operations to Cloudflare's edge. It supports two modes: 'enforce' (returns 403 for invalid certs) and 'report' (forwards requests with certificate status and SKI headers). Cloudflare can also forward client certificate fields as custom headers. The post also highlights the open-sourcing of Cloudflare's PKI tool, cfssl, to assist customers in setting up their own certificate authorities.
  248. You can now use Google Authenticator and any TOTP app for Two-Factor AuthenticationThis post introduces support for Google Authenticator and any Time-based One Time Password (TOTP) app for two-factor authentication (2FA). This expands the existing 2FA offering beyond Authy, giving users more choices for securing their accounts and enhancing the overall security posture of account access management.
  249. python-cloudflareThis post introduces `python-cloudflare`, a Python wrapper for the Cloudflare v4 API, and a command-line interface (CLI) tool. It demonstrates how users can programmatically manage their Cloudflare resources, including listing domains, checking settings like IPv6, creating DNS records, and purging cache. The post highlights the API's structure, its direct mapping to the Python library, and the availability of client libraries for other languages, emphasizing the extensibility and control offered to users.
  250. Sunsetting API v1 In Favor Of CloudFlare’s Current Client API: API v4This post announces the sunsetting of API v1 and the promotion of API v4. It details the extensive new capabilities available through API v4, including programmatic control over a wide range of Cloudflare features such as zone management, SSL certificates, Railgun, custom error pages, analytics, advanced firewall access rules, mobile redirects, and more. It also highlights the developer-friendly aspects of API v4, such as consistent JSON usage and improved namespacing, and provides resources for migration and adoption.
  251. New for Virtual DNS Customers: Self-Service Dashboard and APIs, and Two New FeaturesThis post introduces Multi-User access control for Virtual DNS, allowing team members to manage Virtual DNS instances together. It also highlights advanced security features like the ability to require two-factor authentication across a team for Virtual DNS users.
  252. Introducing Multi-User Organizations: Share An Account Without Sharing A LoginIntroduced Multi-User functionality for Cloudflare accounts, enabling role-based permissions for team members. This feature allows for granular access control, with roles such as Super Administrator, DNS Administrator, and Analytics Administrator. It also supports individual two-factor authentication for each user and provides unique API keys per user, enhancing account security and management.
  253. Red October: CloudFlare’s Open Source Implementation of the Two-Man RuleIntroduced Red October, a Go-based, open-source service implementing the 'two-man rule' for sensitive data protection. It uses a cryptographically-secure encryption/decryption server where multiple authorized users must delegate credentials to decrypt data, preventing single-person misuse. The system employs AES, RSA, and scrypt for cryptographic primitives, with RSA keys encrypted by password-derived keys. It supports JSON-based APIs for encryption, decryption, and credential delegation, with TLS for secure communication.
  254. Today's System-Wide UpgradeThis post details a significant system-wide upgrade and migration of Cloudflare's customer provisioning and accounting systems. The migration involved moving over half a million websites from various legacy systems to a new, modern system. This included rebalancing sites to new IP address pools, seamlessly reissuing SSL certificates (including custom ones), and improving resource allocation efficiency. The new system provides greater flexibility for tagging sites with characteristics like 'adult' content or 'under attack' status, allowing for isolation and dedicated resource allocation. While the migration was largely successful, two minor issues affected a handful of customers: temporary SSL errors due to a web server configuration conflict and a brief period of unreachability for a small number of sites due to an incorrectly recorded null route.