Cloudflare’s 2021 Security Week: Fixing the Internet’s Design Flaws
Cloudflare kicked off its 2021 Security Week today, continuing its pattern of product launches and general availability announcements. While the company has sometimes resisted the “security company” label, roughly half of its products address security concerns. That focus stems from a fundamental reality: the Internet’s original architecture did not build in security from the start.
Tim Berners-Lee’s original web proposal explicitly deferred sophisticated authorization and accounting systems, prioritizing information exchange over secrecy. Foundational protocols show the same gap. The RFC for BGP states plainly that “Security issues are not discussed in this memo,” and the word “security” never appears in the DNS RFC. Those omissions were acceptable when the Internet was an academic experiment; they’re dangerous now that it underpins global commerce and communication.
Cloudflare’s roadmap has effectively been a reverse-engineering effort: encrypting all web traffic for free, encrypting DNS, signing BGP routes, encrypting SNI, mitigating DDoS attacks, patching network software vulnerabilities, and embedding access management into the network. This week’s announcements continue that trajectory.
From MPLS to the Browser
Monday’s focus is MPLS, the widely used network backbone technology. It’s expensive, slow to provision, hard to administer, and has no meaningful security by default. The NSA document from the Snowden leaks—with a smiley face next to “SSL added and removed here”—exposed a fundamental flaw in the MPLS security model. Cloudflare is announcing a fix that also improves speed and cost.
Tuesday moves to the browser, which remains a CISO’s nightmare because every page visit downloads and executes arbitrary code locally. Remote Browser Isolation is the proposed solution, and Cloudflare is opening it to everyone while adding features to Gateway to address the same problem.
Data Permissions, Third-Party Risk, and Bots
Wednesday covers underinvested areas: the weak default permissions and controls in SaaS applications, and APIs that leak more data than intended. The goal is to keep attackers out while ensuring sensitive data stays in.
Thursday tackles third-party risk. A modern web page is a collection of content and applications from many providers, and the weakest link can compromise the whole. Cloudflare is announcing tools to monitor third parties for trouble, from the network level down to individual code on web pages.
Friday brings bot protection technology that was previously reserved for the largest customers to a broader audience, alongside new tools to identify and protect APIs—historically harder to defend against bot attacks.
Partnerships and Practicality
Cloudflare acknowledges it can’t fix the Internet alone. It doesn’t sell hardware, and it doesn’t own the data centers where customers store data. So the week will include partnership announcements with specialists in identity management, endpoint security, and other adjacent areas, aimed at building complete solutions around Cloudflare’s network.
The company is also consciously avoiding the industry’s typical fear-based marketing. Instead of scary hacker imagery, the week will examine recent high-profile breaches and show how Cloudflare’s products—and others’—can protect against those specific attacks.
Beyond the Week
The volume of announcements nearly earned the event the name “Security Fortnight.” CloudflareTV will host conversations with security experts and product managers throughout the week, with a schedule available for live viewing and questions.
Despite grim cybersecurity headlines, Cloudflare strikes an optimistic tone: the underlying flaws of the Internet can be fixed, and the company says it has been doing exactly that for over a decade. This week represents the next major step in that project.
