How Cloudflare implemented hardware keys with FIDO2 and Zero Trust to prevent phishing
Sep 29, 2022Evan Johnson, Derek Pitts
Summary
This post details Cloudflare's internal migration from VPN-based authentication with TOTP to a Zero Trust architecture enforced by Cloudflare Access and FIDO2/WebAuthn security keys. It describes the selective enforcement strategy using OAuth2 AMR values and Terraform, the eventual full enforcement of FIDO2, and the extension of this security model to SSH connections via Cloudflare Tunnel and cloudflared.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack