Secure by default: recommendations from the CISA’s newest guide, and how Cloudflare follows these principles to keep you secure
Apr 20, 2023Patrick R. Donahue, Ed Conolly
Summary
This post details Cloudflare's adoption of 'Secure-by-Design' and 'Secure-by-Default' principles, aligning with CISA's recommendations. It highlights the rewrite of the WAF evaluation engine in Rust for memory safety and performance, and the automatic provisioning of SSL certificates as examples of these principles. The ML-computed WAF Attack Score is presented as a mechanism for protecting against zero-day attacks without manual configuration. Cloudflare Tunnel is also discussed as a secure-by-default solution for network connectivity.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack