Cloudflare expands Zero Trust controls for high-risk browsing
Cloudflare has extended its Browser Isolation service with controls designed to blunt phishing attacks and credential theft on websites that fall outside established trust categories. Administrators using Cloudflare's Zero Trust platform can now define policies that block keyboard input and file transfers when users visit destinations deemed risky, without forcing those sites to be blocked outright.
The update builds on data protection capabilities added to Browser Isolation earlier this year. Because the remote browser mediates all interaction between the user and the website, Cloudflare is able to enforce restrictions at the input/output layer, rather than relying on the user's local browser to comply.
The limits of allow/block web filtering
Traditional Secure Web Gateway (SWG) deployments filter traffic based on threat intelligence feeds, which works reasonably well for known malicious destinations. But much of the web falls into a gray area. A domain that resembles an established site via typosquatting, or that has been registered recently, could be entirely benign — or could be staged for a phishing campaign. Administrators who block these uncategorized destinations risk false positives that hurt productivity and generate exception requests. Those who allow them expose their teams to unknown risk.
Cloudflare Gateway approaches filtering with visibility derived from its network, which processes more than one trillion DNS queries daily. That scale lets Cloudflare model what normal DNS behavior looks like and flag anomalies that could indicate threats such as DNS tunneling. Cloudflare Radar publicly exposes some of this research. Even so, newly registered or newly seen domains can take time to categorize, leaving a window where users would otherwise need to request exceptions if their team blocks these categories.
Read-only browsing for unknown sites
Rather than blocking unknown destinations outright, Browser Isolation shifts the risk of executing untrusted code from the user's endpoint to a remote browser running in a low-latency data center. Administrators can apply this approach to categories that Cloudflare's network tracks as higher risk, including typosquatting and new domains. When a user lands on such a site through an isolation policy, the site is rendered in read-only mode: file uploads, downloads, and keyboard input are disabled.
This configuration allows users to view the content of an unfamiliar site without being able to leak credentials, transmit files, or fall victim to a phishing attempt. If a user has a legitimate need to interact with a particular site, the expectation is that they will contact their administrator to request elevated permissions for that browsing session. Policy details are documented in the Cloudflare developer documentation for remote browser policies.
Deployment and availability
Browser Isolation is natively integrated into Cloudflare's Secure Web Gateway and Zero Trust Network Access services, avoiding the need to assemble separate products or ask users to switch browsers. The feature is included with the Cloudflare for Teams Enterprise Plan at no additional charge for the first 2,000 seats until the end of 2021, with onboarding available through Cloudflare's Zero Trust page.
