Bringing Data-Loss Controls Into the Isolated Browser
Cloudflare has extended its Browser Isolation service with new data protection controls, giving administrators the ability to define Zero Trust policies that govern copy, paste, and print actions inside any web application. The features are available today in the Cloudflare for Teams dashboard and can be applied with per-rule granularity to existing or new HTTP policies.
The announcement follows the general availability of Browser Isolation, which Cloudflare introduced during Security Week in March 2021 as an add-on to its Cloudflare for Teams suite. The core premise of the service is straightforward: shift the execution of untrusted website code away from the user's local machine and into a secure, remote browser running on Cloudflare's edge. That approach has been positioned as a defense against browser-borne malware and zero-day exploits, since malicious code never touches the endpoint.
Cloudflare is also making the service more accessible by bundling it with the Teams Enterprise Plan at no additional charge for up to 2,000 seats until December 31, 2021.
A Third Way to Approach Remote Browsing
Web browsers have evolved from simple document viewers into full application platforms, which has made them both a primary productivity tool and a prominent attack surface. Legacy defenses such as DNS or HTTP inspection can block known threats, but they often rely on pattern matching that produces false positives and does little against unknown vulnerabilities.
Browser isolation vendors have historically asked administrators to pick between two imperfect models:
- Security-first pixel pushing: The remote browser renders the page and sends a visual representation (pixels) to the user. This avoids sending foreign code to the endpoint but suffers from latency, graphical artifacts, and high bandwidth consumption.
- Performance-first code scrubbing: The remote server unpacks, inspects, and repacks the page before sending it to the local browser. This route often breaks page functionality and can still let undetected threats through.
Cloudflare's implementation takes a middle path. The remote browser executes all website code and never sends it to the endpoint, but instead of pixels, it transmits lightweight vector instructions over the wire. Because the remote browser sits on Cloudflare's global edge network, latency is minimized. This design aims to deliver the security of pixel pushing without the performance penalty.
Why Data Control Belongs in the Browser
Threats aren't the only concern. The browser is where most employees interact with company data, often inside SaaS applications that administrators can't easily govern once content is rendered locally. Traditional data loss prevention tools focus on pattern recognition to redact sensitive fields like PII or PCI data. That model works for structured data, but it breaks down in industries like healthcare, where staff need to see patient notes and appointment details to do their jobs. Redaction would render those workflows unusable.
Once data is visible in a browser, it's trivial for a user to copy it into another website, print it, or otherwise move it outside the controlled environment—actions that can easily result in accidental data exposure. Some organizations have resorted to deploying full virtual desktop infrastructure just to add controls around a single SaaS tool, a heavy and costly solution that hurts user experience.
One-Click Controls for Copy, Paste, and Print
Since Browser Isolation executes all page content including HTML in the remote environment, Cloudflare is able to intercept and enforce restrictions on user actions before they happen. Administrators can toggle copy-paste and printing on or off based on application, hostname, user identity, and security risk, all from the Teams dashboard. These settings apply at the policy level, so it's possible to block copying from a CRM while leaving printing enabled on other sites where it doesn't present a risk.
For users, the experience is unchanged until they attempt a restricted action—at which point the browser steps in and blocks it.
Configuring the controls requires only a few steps:
- Navigate to the Cloudflare for Teams dashboard.
- Go to Gateway → Policies → HTTP.
- Create or update an HTTP policy with an Isolate action (see the docs).
- Configure policy settings.
Roadmap and Availability
Cloudflare says these data controls are only the first step in a broader set of zero trust browsing features. The company is developing protections against phishing, controls for file uploads and downloads that would otherwise require complex network policies, and a fully clientless browser isolation experience.
The inclusion of Browser Isolation in the Teams Enterprise Plan is a deliberate effort to bring remote browsing security within reach of smaller organizations, which previously would have had to justify the cost of a separate isolation product and accept the compromises inherent in loosely integrated solutions. Cloudflare is betting that bundling the technology with its existing Zero Trust suite, at no extra cost for now, will make it a practical option for businesses of all sizes.
