Talk Transcript: How Cloudflare Thinks About Security

This post details Cloudflare's internal security culture, emphasizing a blame-free approach to encourage reporting of security incidents, including lost devices and phishing attempts. It also describes the use of HackerOne and a private bug bounty program for external vulnerability discovery. The post highlights the critical importance of identity and authentication, detailing Cloudflare's migration to a unified system using Cloudflare Access, strong password policies, and mandatory two-factor authentication with YubiKeys and TOTP. It discusses the company's commitment to openness and transparency, exemplified by detailed public disclosures of incidents like Cloudbleed and a recent outage. Finally, it outlines the shift towards memory-safe languages like Go and Rust for new product development and the increased focus on monitoring system crashes, with the CSO reporting directly to the CEO to underscore security's top-down importance.