Secure by default: recommendations from the CISA’s newest guide, and how Cloudflare follows these principles to keep you secure

Secure by Default: Why Security Can't Be the Customer's Job

Imagine buying a house where the locks are all keyed alike, the windows don't latch properly, and the alarm system requires monthly firmware updates just to stay functional. That wouldn't be acceptable, yet this is precisely how many technology products are shipped today — requiring customers to change default credentials, apply patches, and harden configurations before they're safe to use.

A recently published guide from the Cybersecurity and Infrastructure Security Agency (CISA), jointly authored with the NSA, FBI, and agencies from the UK, Australia, Canada, Germany, Netherlands, and New Zealand, argues this burden should shift back to manufacturers. The principles of Secure-by-Design and Secure-by-Default ask vendors to build products that are safe to use out of the box, rather than requiring customers to constantly monitor, update, and repair their systems.

The authoring agencies strongly encourage every technology manufacturer to build their products in a way that prevents customers from having to constantly perform monitoring, routine updates, and damage control on their systems to mitigate cyber intrusions. Manufacturers are encouraged to take ownership of improving the security outcomes of their customers.

Cloudflare builds cybersecurity products that protect employees, applications, and networks. When new product ideas emerge — whether from customer requests or internal security needs — the goal is to make security administrators' lives easier. Customers should have to do less, but get more.

An early example of this approach is Universal SSL, introduced in 2014. At the time, every other platform required customers to acquire certificates themselves, upload them, and handle renewals. Because Cloudflare manages authoritative DNS for customers and runs a global reverse proxy, it could automatically provision SSL certificates for all customers, including Free plans.

For all customers, we will now automatically provision a SSL certificate on CloudFlare's network that will accept HTTPS connections for a customer's domain and subdomains.

In addition to simplifying the initial setup, Cloudflare automatically improves how its servers negotiate encryption as new SSL/TLS attacks are discovered — requiring no customer configuration or oversight. The same philosophy applies to Web Application Firewall (WAF) protections. Most WAFs rely on signature matching, which means they're only as good as the most recently released rule. To defend against "zero day" attacks like Log4j — vulnerabilities exploited before a patch exists — Cloudflare trains machine learning models on true positive matches. These models can infer the likelihood that a new request is malicious even when it doesn't match a known signature, letting customers write one rule up front and remain protected against attacks that haven't been discovered yet.

A similar secure-by-default design guided Cloudflare One, the zero trust suite initially built to protect Cloudflare's own internal networks. Instead of requiring administrators to open firewall ports for remote access — and then manage configuration drift over time — Cloudflare Tunnel establishes mutually authenticated, encrypted connections directly to Cloudflare's edge. Access to specific applications is gated by strongly-authenticated users rather than IP and port holes not tied to a known identity.

Secure by Design: Investing in the Invisible

Secure defaults alone aren't sufficient. How products are built matters equally in minimizing vulnerabilities. Cloudflare's engineering team learned this when its original WAF, written in Lua, started showing its age. In 2017, the team faced a choice: continue bolting on features to close the competitive gap, or invest in a complete rewrite in a memory-safe language.

The rewrite was completed in Rust — a language immune to entire classes of buffer overflow vulnerabilities. The new evaluation engine not only improved security but ran 40% faster. A similar "XL-sized" project called Pingora replaced NGINX as Cloudflare's reverse proxy engine, also in Rust. These were costly projects with no immediate customer-visible feature payoff, but they required full support from executive leadership.

Secure-by-Design development requires the investment of significant resources by software manufacturers at each layer of the product design and development process that cannot be "bolted on" later. It requires strong leadership by the manufacturer's top business executives to make security a business priority, not just a technical feature.

The authoring agencies explicitly acknowledge these investments may be invisible to customers and may increase development costs. Yet the tradeoff is clear: products built this way substantially improve customer security posture and reduce the likelihood of compromise.

Putting the Principles into Practice

Building secure products that are easy to adopt and require minimal ongoing oversight requires an aligned organization. The following techniques have proven effective at Cloudflare:

Move the operational burden to your infrastructure

Enterprise networking equipment often ships into heterogeneous environments where updates can go wrong — which is why administrators delay applying them. Maintaining a single software stack that runs on every server in the fleet makes it immeasurably easier to stay on top of updates for customers, and shifts the burden away from overburdened administrators to a team that can manage changes centrally.

Educate leadership and build credibility

The economic environment is challenging, and scarce engineering resources face competing demands from new features, technical debt, and security hardening. Laying out clear business cases for secure defaults and secure design improves the chances of investment. Scope projects appropriately and run experiments early — sharing proof-of-concepts before they're fully built can surface unexpected organizational support and benefits customers will embrace.

Embed security experts with engineering teams

Application security experts can quickly pattern-match security "code smells" based on prior reviews. Embedding these practitioners within product engineering teams lets them provide guidance at the earliest — and lowest cost — phase of development. Having them review functional specifications saves development cycles downstream.

Incentivize automatic security

Businesses built on professional services revenue have little incentive for software developers to minimize installation and hardening effort. But when products are consumed by hundreds of thousands of customers of all sizes, doing more for customers out of the box becomes a requirement — otherwise support organizations get overwhelmed and customers remain vulnerable.

Avoid default passwords at all costs

Every day, Cloudflare mitigates DDoS attacks launched by botnets comprised of insecure-by-default devices. Many IoT devices ship with easy-to-guess or universal credentials, and some proxy vendors require no authentication out of the box. If manufacturers followed these principles, attacks would decrease in both intensity and frequency.

The security landscape is unforgiving, and the rate of exploitation continues to accelerate. Building products where the manufacturer, not the customer, owns the security outcome breaks the vicious cycle of shipping vulnerable software and issuing patches that may never be applied. It requires making security a core business priority — not a technical afterthought.