Secure by Design Principles

1 post · Apr 2023 – May 2025

What this trail covers

Cloudflare is actively integrating and promoting CISA's 'Secure by Design' principles across its product development lifecycle. This involves building security into products from the outset, configuring them securely by default, taking ownership of customer security outcomes, embracing radical transparency and accountability, and leading from the top. Examples include the adoption of memory-safe languages like Rust for critical components (WAF, Pingora proxy), the default provision of security f

All Cloudflare trails

May 2025Vulnerability transparency: strengthening security through responsible disclosureThis post details Cloudflare's commitment to transparency in vulnerability reporting as part of its 'Secure by Design' pledge with CISA. It explains the role of CVEs and Cloudflare's process as a CVE Numbering Authority (CNA), including its bug bounty program and disclosure timelines. Notable CVEs issued by Cloudflare are highlighted, such as memory exhaustion in quiche, information disclosure in the WordPress plugin, and privilege escalation in the WARP client. The post also discusses a mutual TLS vulnerability where Cloudflare was impacted but the root cause was external, leading to disclosure via a blog post. It encourages other organizations to adopt 'Secure by Design' principles.
Mar 2024Changing the industry with CISA’s Secure by Design principlesThis post introduces Cloudflare's commitment to CISA's 'Secure by Design' principles. It details how Cloudflare bakes security into its products by adopting memory-safe languages (Rust for WAF and Pingora), offering Zero Trust by default, providing Universal SSL, unmetered DDoS mitigation, free WAF Managed Rulesets, and post-quantum cryptography. It also highlights secure default configurations like the free Managed Ruleset and ML-computed WAF Attack Score, and the availability of audit logs. The post emphasizes radical transparency through blog posts on security incidents and industry-wide threats.
Apr 2023Secure by default: recommendations from the CISA’s newest guide, and how Cloudflare follows these principles to keep you secureThis post details Cloudflare's adoption and implementation of CISA's 'Secure by Design' and 'Secure by Default' principles. It highlights how Cloudflare builds products that are secure out-of-the-box with minimal customer configuration, citing Universal SSL, ML-computed WAF Attack Score, and Cloudflare Tunnel as examples. It also emphasizes the engineering investment in secure development practices, including the rewrite of the WAF engine in Rust for memory safety and performance, underscoring executive leadership's support for security as a business priority.
Advertisement