A Strategy Built on Shared Responsibility

On March 2, 2023, the Biden-Harris Administration released its National Cybersecurity Strategy, a comprehensive policy document aimed at making the digital ecosystem more defensible and resilient. The strategy signals a fundamental shift in how the United States approaches cyber defense. Instead of placing the burden on individuals, small businesses, and local governments, the new approach directs responsibility toward the organizations best positioned to reduce risk—namely data holders and technology providers. The strategy also calls for realigning incentives to favor long-term investments in resilience, even as the country addresses urgent threats.

The strategy is organized around five pillars:

  • Defending critical infrastructure.
  • Disrupting and dismantling threat actors.
  • Shaping market forces to drive security and resilience.
  • Investing in a resilient future.
  • Forging international partnerships to pursue shared goals.

Cloudflare has responded to the strategy by pointing to existing programs and products that align with the government's objectives. The company has endorsed the plan's emphasis on protecting essential services such as hospitals, utilities, and the organizations that support them, and has highlighted its ongoing work in Zero Trust security, threat intelligence sharing, and privacy-preserving technology.

Zero Trust as a Defensive Baseline

The strategy places significant weight on the Zero Trust framework, a model rooted in the principle of "never trust, always verify." No user or device is trusted by default, whether inside or outside a network; everyone must prove their identity and permissions before accessing resources. This approach is already a core component of Cloudflare's security offerings.

In response to warnings from CISA and international partners about potential retaliation following sanctions on Russia, Cloudflare has offered several free resources aimed at improving cyber readiness. The company also launched the Critical Infrastructure Defense Project (CIDP) in partnership with CrowdStrike and Ping Identity, providing a suite of products free of charge for four months to any United States-based hospital, energy utility, or water utility. Additionally, Cloudflare has extended free access to its Zero Trust products to participants in Project Galileo and the Athenian Project, which support civil society organizations and government entities that may lack the budgets for enterprise-level security tools.

Threat Intelligence and Network Defense

The strategy calls for disrupting and dismantling threat actors through collaboration between the public and private sectors. Cloudflare participates in the Joint Cyber Defense Collaborative, working alongside the US government and other organizations to share visibility into malicious activity and coordinate responses. The company's network is global and learns from each attack it mitigates, which Cloudflare says improves its ability to detect and stop new threats. On average, the network blocks 136 billion cyber threats per day. In February 2023 alone, Cloudflare mitigated a record-breaking 71 million request-per-second DDoS attack—the largest reported HTTP DDoS attack on record, exceeding the previous high of 46 million rps set in June 2022.

Privacy-Preserving Technologies

The strategy also highlights investments in privacy-preserving technologies as part of building a resilient future. Even with encryption, metadata such as IP addresses and the names of visited websites can leak through protocols not designed with privacy in mind. Cloudflare has been developing tools that reduce the availability of that information.

Products in this area include Privacy Gateway, a managed relay for Oblivious HTTP that prevents internet service providers from knowing the sites a subscriber visits, while also hiding the visitor's true IP address from websites. Private Relay adds a second server to that relay chain for additional obfuscation. WARP is a free proxy application that encrypts traffic from a user's device and routes it through Cloudflare's network. And the 1.1.1.1 resolver is a public DNS service that supports encrypted DNS queries to enhance privacy.

Post-Quantum Readiness and Protocol Improvements

The strategy encourages federal agencies and the private sector to prepare for a future in which quantum computers might break current cryptographic standards. Cloudflare states that all websites and APIs served through its network now support post-quantum hybrid key agreement by default, a change the company announced in October 2022. The company offers this capability free of charge, arguing that post-quantum security should become the baseline for the Internet.

The strategy also addresses technical weaknesses in fundamental Internet protocols, including vulnerabilities in the Border Gateway Protocol (BGP), the prevalence of unencrypted DNS, and sluggish IPv6 adoption. Cloudflare has supported improvements in these areas, including work to secure BGP via Resource Public Key Infrastructure (RPKI) and the deployment of encrypted DNS options such as DNS over HTTPS, DNS over TLS, and Oblivious DNS over HTTPS.

International Collaboration

Because cyber attacks do not respect borders, the strategy's fifth pillar focuses on international partnerships. Cloudflare has pointed to its direct experience supporting Ukraine following Russia's invasion, and has described its work to keep the open Internet accessible in that region. In December 2022, the company launched Project Safekeeping, modeled on the CIDP program, which offers enterprise-level Zero Trust protection at no cost to eligible entities in Australia, Germany, Japan, Portugal, and the United Kingdom, with no time limit on the offering.

Alignment and Move Forward

The National Cybersecurity Strategy represents a comprehensive and constructive roadmap for hardening the country's digital infrastructure. The document's emphasis on shared responsibility and the importance of private sector participation aligns with Cloudflare's corporate mission and existing engineering efforts. The company has stated that it looks forward to continued collaboration with the US government on pursuing a more secure and resilient Internet.