Cloudflare Builds Data Loss Prevention Into Its Network

Cloudflare has announced a data loss prevention (DLP) platform built on top of its global network and integrated into Cloudflare One, its Zero Trust security offering. The approach is designed to give enterprises visibility into how data moves, control over who can access it, and the ability to scan traffic inline—without forcing traffic backhaul through on-premise appliances.

The company's argument is straightforward: the traditional castle-and-moat model of enterprise security no longer works. Users connect from anywhere, and applications live in environments outside corporate control. Point solutions that try to recreate that model typically slow down users or drive up costs by forcing traffic through a central location for inspection. Cloudflare's approach relies on the same infrastructure that accelerates traffic to perform security inspection, regardless of how traffic arrives on its network.

Step 1: Rebuild visibility with comprehensive logging

Before the shift to remote work and cloud applications, security teams could monitor every request because all services lived in a private data center and users connected from managed office networks or VPN clients. That visibility disappeared when data left on-premise storage.

Cloudflare's answer is a phased DLP rollout. The first phase, already available, captures and logs every DNS query, request, and file upload or download in an organization. The DNS filter, built on the same technology as the 1.1.1.1 resolver, can be deployed to office networks and roaming devices in under an hour. Layering on the Secure Web Gateway, built on the consumer WARP technology, adds context to traffic leaving endpoints.

For cases where connections bypass the DNS filter or gateway, teams can log HTTP method, URL path, and other request metadata without on-premise appliances. Administrators can also build rules that force every login to a SaaS application through Cloudflare's network before a user reaches an identity provider, eliminating blind spots over data access. All DNS and HTTP logs can be exported to an existing SIEM provider.

Step 2: Enforce RBAC across all applications

Visibility often reveals a second problem: too much data available to too many people. Many enterprises have information spread across hundreds of applications, and the default permission model in most of those applications allows any team member to reach any record. That makes every user account a potential attack surface for data loss.

Configuring role-based access controls (RBAC) in every application is tedious, and some applications don't support RBAC at all. Cloudflare's Zero Trust platform lets teams build need-to-know rules in a single place, across both internally-managed and SaaS applications. A common first target is a CRM system, where records vary in sensitivity but employees across marketing, legal, and finance can often reach everything.

Using the Secure Web Gateway, administrators can create rules that restrict who can reach a specific part of any application, using the identity provider as the source of truth. File upload/download policies can also prevent users from saving data locally. For certain datasets that require additional scrutiny, such as a hard key as a second factor or restrictions to specific countries, these same controls can be applied. Cloudflare says URL-path-based controls on data sets in any application are coming soon.

Step 3: Protect external-facing applications from data leaks

Controlling who can reach data only helps if applications aren't leaking it through other channels—a forgotten API endpoint or a weak, reused password, for example. Existing point solutions for this problem require manual configuration per application and cumbersome development practices.

Cloudflare is launching a new feature in its Web Application Firewall (WAF) to address this. Administrators can apply rules to any web resource protected by Cloudflare's reverse proxy, and the network will scan responses for data that should never leave the application, blocking it when found. At launch, the service includes patterns for credit card numbers and social security numbers, with additional patterns and custom data search capabilities to follow. The goal is to avoid burdening teams with manual data classification.

Step 4: Scan all outbound traffic inline

Until now, teams looking to scan all data leaving their organization faced poor options:

  • Backhauling all traffic through on-premise appliances that scan before sending traffic to the Internet, slowing down the entire experience
  • Purchasing expensive out-of-band solutions hosted in a few cloud environments, which also degrade performance
  • Doing nothing and allowing data to reach the Internet unchecked

Coming soon, Cloudflare will let customers scan all traffic leaving devices and locations for data loss without the performance penalty of legacy options. Rules can be built in a single place, checking data against common patterns like PII, against exact data sets, or using data labels. These DLP rules can be combined with other Zero Trust rules—for example, preventing users outside a specific group from uploading a file containing certain key phrases to anything other than corporate cloud storage.

The technical distinction is that Cloudflare's DLP runs inline on the same hardware that accelerates traffic, unlike the out-of-band appliances or cloud-hosted solutions that add latency. The company notes its network is carrier-agnostic and well-peered, and can apply Argo Smart Routing technology, which it says has reduced latency by 30% or more in real-world use.

When users connect through the WARP agent or Magic Transit on-ramp, they reach one of Cloudflare's data centers in 200 cities. That data center checks traffic against security rules, logs events, scans for data patterns, and then uses the global private backbone to accelerate the connection to its destination.

Availability

Logging and RBAC controls are available today within the Cloudflare for Teams product. Teams Free plan users have access to the features needed to get started for up to 50 users. The DLP data scanning capabilities will be added to Cloudflare for Teams later this year, and interested parties can join a waitlist.