Cloudflare Data Loss Prevention now Generally Available

Data Loss Prevention is now available for Cloudflare contract customers, giving customers more options to protect their sensitive data

C

CloudflareCloudflare

·September 20, 2022

Cloudflare Data Loss Prevention now Generally Available

Cloudflare DLP Hits General Availability

Cloudflare has announced that its Data Loss Prevention (DLP) service is now generally available to all customers. The product, which entered beta in July 2022, is designed to give organizations visibility and control over sensitive data as it moves through corporate networks.

Protecting Data by Characteristics

DLP is built to address a growing challenge for IT and security teams: tracking sensitive information across an expanding array of cloud tools and employee endpoints. The service inspects traffic flowing into and out of corporate infrastructure, scanning for indicators of sensitive data based on keywords or patterns. When matches are found, administrators can allow or block the traffic according to predefined rules.

The primary use case is protecting Personally Identifiable Information (PII), but the service can also be applied to intellectual property, source code, corporate financial data, or any other business-critical information.

Part of a Broader Zero Trust Platform

DLP operates as part of Cloudflare One, the company's Zero Trust network-as-a-service platform. Traffic from data centers, offices, and remote users is routed through Cloudflare's network, where it can be subjected to multiple layers of security: identity and device posture validation, malware and phishing filtering, SaaS configuration checks, and Browser Isolation. All of this is managed through a single control plane.

The service leverages Cloudflare One's existing HTTP filtering capabilities. By using filtering options such as domain, URL, application, or HTTP method, administrators can segment which traffic gets DLP inspection. When applied, HTTP requests are decompressed, decoded, and scanned for regex matches. Numeric matches are then validated algorithmically where possible, using checksums or Luhn's algorithm; some detections, like US Social Security numbers, don't support such validation.

Configuring DLP Profiles

Getting started with DLP involves configuring profiles in the Zero Trust Dashboard. Under Gateway, navigate to DLP Profiles and select the type of data you want to protect. Currently, Cloudflare detects credit card numbers and US Social Security numbers. The company says it plans to expand this library with custom and additional predefined detections, including more international identifiers and financial record numbers, in the near future.

Detections can be enabled individually. Card number detections rely on regex patterns validated with Luhn's algorithm, and administrators can also configure text-based matches for card names like "American Express." These detections are then applied to Gateway HTTP policies on specific traffic—for example, blocking Google Drive uploads and downloads containing US Social Security numbers.

A Holistic Data Security Approach

Cloudflare positions DLP as one component in a more comprehensive data security strategy. The Zero Trust platform offers several complementary controls from a single interface:

Zero Trust Network Access (ZTNA) enforces identity-aware, granular access policies to protect data in transit.
Secure Web Gateway (SWG) applies corporate tenant controls per application.
Remote Browser Isolation (RBI) restricts how users interact with browser-based data, limiting downloads, copy/paste, and printing to local devices.
Cloud Access Security Broker (CASB), also announced as generally available today, detects SaaS misconfigurations that could lead to data leakage for data at rest.

These services are designed to work together, and Cloudflare says its architecture will allow the DLP offering to deepen its capabilities while remaining integrated with the broader platform.