Heartbleed Revisited
Mar 27, 2021Nick Sullivan
Summary
This post revisits the Heartbleed vulnerability from 2014, highlighting how Cloudflare has incorporated its lessons into its security posture. It details advancements in TLS/SSL key protection and management, including Keyless SSL, Geo Key Manager, Keyless Everywhere, and Delegated Credentials, which provide defense-in-depth against key compromise. It also discusses improvements in certificate revocation mechanisms, such as OCSP stapling and OCSP Must-staple, to mitigate the impact of future key compromises. The post contrasts the security landscape of 2014 with the present, showcasing Cloudflare's continuous innovation in TLS/SSL security.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack