PRODUCT OVERVIEW

Integrated DLP & CASB
Cloudflare One improves data visibility and reduces risk of
exfiltration as data moves across all web, SaaS, andself-hosted/private apps.

Protect data everywhere~81% of breaches now involve datastored in cloud environments.

75%

Reduced costs (or less)associated with using
multiple point solutions 1

Today, organizations are processing more data thanever. Customers entrust businesses with their personal
information. Modern knowledge workers need toleverage and share data to across cloud and SaaS
environments to do their jobs. And code is now acompany’s crowned jewel, growing rapidly in volume
everyday. Sensitive data now essentially lives
everywhere.

69%

Minimized time spent on lowvalue tasks (i.e. setup &configuration of threat
defense policies 1

Integrated Data Loss Prevention (DLP)+ Multimode Cloud Access Security Broker (CASB)

20%

Decreased likelihood andrelated costs of a data
breach 2

Built into one composable SSE platform, Cloudflare DLP
and CASB easily extends visibility and unifies dataprotection controls across all apps, users, and devices.
Deployment simplicity and flexibility for administrators,
ensures that policies are functional, not shelfware.

Embrace SaaS apps and the cloud securely

Avoid regulatory fines

Simplify SaaS security

Scale at your own pace

Mitigate financial andreputational damages causedby data compliance violations
with more streamlined policy
enforcement for regulated data.

Empower your business tosafely and confidently adopt
new SaaS apps. Eliminate blind
spots with continuous detection
and control over SaaS risks.

Layer on data security without
disrupting day-to-day
operations. Configuration issimple and end userexperiences are seamless.

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-SEPT2023

Cloudflare | DLP & CASB

Top use cases for DLP & CASB
Simplify regulatory compliance
Reduce the risk of compliance violations caused bydata breach with a comprehensive Zero Trust security
posture. DLP identifies and apply controls to regulated
data classes (PII, health, financial). Additionally,maintain detailed data audit trails via logs and further
SIEM analysis for ease compliance efforts.

Increase visibility of data and misconfiguration risks
You can’t protect what you don’t know. Cloudflare
CASB scans SaaS suites for misconfigurations anddata threats with integrated DLP detections forsensitive data. Quickly gain visibility acrossunsanctioned app usage, such as emerging AI tools
like ChatGPT and Bard. Then reduce risks with allow,
block, isolate, or apply Zero Trust controls to accessthem.
Safeguard valuable IP and developer code
CASB detects and remediates misconfigured public
repositories like GitHub that risk code leaks. For
source code in transit, apply granular DLP controls toblock users from up/downloading to any apps ordevice.

Getting started with unified data protection
Be more proactive with your data protection with a Zero Trust approach. Determine how corporate users areusing SaaS, web, & private apps and granularly identify which ones they are using. Then accordingly, apply data
controls and identity/device-driven policies to shrink your attack surface.

Gain visibility over data movement

Detectinappropriate
sensitive data
sharing in
SaaS apps

Detectunsanctionedand sanctioned
SaaS apps

Integrate logswith SIEM
providers forauditing*Reduce risk of data exfiltration

Apply DLPcontrols towhat/wheredata moves
into any app

Isolatethreats ofdata leaving
SaaS andprivate apps*

Secure accessto SaaS andself-hosted
private/cloudapps**using ZTNA, SWG, and/or RBI capabilities in the SSE & SASE platform
1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-OCT2023

Cloudflare | DLP & CASB

How DLP Works
The migration to the cloud has made tracking and controlling sensitive information more difficult than ever.
Employees are using an ever-growing list of tools to manipulate a vast amount of data. Meanwhile, IT andsecurity managers struggle to identify who should have access to sensitive data, how that data is stored, andwhere that data is allowed to go.
Data Loss Prevention enables you to protect your data based on its characteristics, such as keywords orpatterns. As traffic moves into and out of corporate infrastructure, the traffic is inspected for indicators ofsensitive data. If the indicators are found, the traffic is allowed or blocked based on the customers’ rules.

Easy, quick controls overregulated data classes

Advanced customization for
constant changing data needs

Seamless integration withexisting data classification tools

Compliance requirements are
getting stricter and moreexpansive. Quickly enable
predefined DLP profiles to parse
employee network traffic andblock sharing of regulated data,such as PII, PHI, and otherfinancial information (e.g.,banking / credit card numbers).

The definition of sensitive data
can vary drastically acrossorganizations depending on
industry and operating locations.
Apply granular controls to otherdata types, such as secrets, code,
credentials, and IP, by creatingcustom DLP profiles with context
analysis and Exact Data Match.

Maintaining a thorough inventoryof sensitive data is a massive lift
for security teams and therefore
require data classification tools
like MIP. Increase agility, notcomplexity with our integrations
that automatically retrievesensitivity labels and populate
into a DLP profile.

Share oraccess stored
sensitive data
at-restPredefined DLP Profiles
Financial, Identifiers,Creds/Secrets, CodeFull HTTP
body scan for
sensitive datain-transit

Data
Custom DLP Profiles
Out of banddata interactions
In-line datainteractions

Regular Expression, MatchCount, Context Analysis
DetectInternet &SaaS apps

Exact Data Match (EDM)
Upload Custom Sets ofNames, Address, Phone, CodeAny User

Based on context
AllowBlockIntegration Profiles

Private & selfhosted apps

Microsoft Information
Protection (MIP) Labels

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-OCT2023

Cloudflare | DLP & CASBHow CASB Works
Natively built SSE delivers inline CASB for consistent
data control across all apps and devices

Easy API CASB integrations provides quick risk
visibility across your managed SaaS apps

Each SaaS app requires different security
considerations, and operate outside the safeguards ofthe traditional perimeter. As organizations adopt
dozens SaaS apps, it becomes increasingly
challenging to maintain consistent security, visibility,and performance.

Connect to popular SaaS apps (Google Workspace,Microsoft 365, etc.) in just a few minutes with quick
API read-only integrations.
Maintain strong SaaS security posture and empower
your IT and security teams with visibility intopermissions, misconfigurations, improper access, andcontrol issues that could leave their data andemployees at risk. Then, quickly remediate CASB
surfaced threats with easy click SWG policies andintegrated DLP scanning.

To protect data in transit, our inline CASB places
ZTNA, SWG, and RBI controls in front of your apps.
●●●Log every HTTP request to reveal Shadow IT
Block/isolate threats and risky data sharing
Secure access to any SaaS app

Apps

User

Managed SaaS Apps
WHAT

Clientless
AccessClient onDevice

Router inOffice

Discover shadow IT/ manage apps

HOW
CASB via
SWG Analytics

Detect config
vulnerabilities

SaaS PostureManagement

Block or isolateapps & tenantsCASB via
SWG Policies

via
Proxyvia
API+More

Unmanaged SaaSor Internet Apps

Verify & segment
users to apps

CASB via
ZTNA Policy

Control data at rest& in transit

CASB via
DLP Scanning

Data intransit+Morevia
Proxy

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

Data atrest & intransit

via
API

REV:PMM-OCT2023

Cloudflare | DLP & CASB

What customers are saying“Today, Cloudflare One helps prevent our users from sharing
sensitive data and code with tools like ChatGPT and Bard, enabling
us to take advantage of AI safely…

Cloudflare replaced point
solutions Zscaler ZIA andCisco AnyConnect VPN.

Going forward, we are excited for Cloudflare’s continued
innovations to protect data, and in particular, their vision androadmap for services like DLP and CASB.”

More broadly helped Applied
Systems consolidate security
across employees, applications,and networks.

— Applied Systems, Tanner Randolph, CISO

Read the case study

What analysts are saying

Cloudflare named a Strong Performer in The Forrester
Wave™: Zero Trust Platforms, Q3 2023

Cloudflare is the only new vendor in the 2023
Gartner® Magic Quadrant™ for SSE

Cloudflare cites continued disruptive momentum inSSE market demonstrated via analyst recognition,
receiving the highest scores possible, 5.0/5.0, in theinnovation, roadmap, pricing flexibility & transparency,
and hybrid workforce enablement & protection criteria.

Cloudflare has been recognized in the 2023 Gartner®
Magic Quadrant™ for Security Service Edge (SSE)
report. We believe our recognition validates ourcommitment to continue advancing our Zero Trust
platform to help secure hybrid work.

According to the report, “Cloudflare’s various network,
DLP, and access control policies are managed from asingle console, allowing customers to quickly deploy
and protect against Internet-born threats.”

Read full report

Read full report

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-OCT2023

Cloudflare | DLP & CASB

Integrated DLP Capabilities
DLP Profiles

Define the data patterns you want to detect.
● Predefined DLP Profiles: Financial information (e.g.. credit card numbers), national identifiers(PII), Health Information (PHI), credentials & secrets (e.g. GCP/AWS keys), and source code
● Custom Profiles: Build custom detections to identify unique types of sensitive data (e.g.
internal project names, unreleased product names)

Data classification

Integrate DLP with third-party data classification providers like Microsoft Information Protection(MIP) sensitivity labels. Retrieve classification information from provider, populate into Cloudflare
DLP Profile, and enable policy to allow or block matching data.

Match countSet custom match counts for number of times that any enabled entry in the profile can bedetected before an action is triggered, such as blocking or logging.

Context analysis

Context analysis to restricts DLP detections based on proximity keywords (~1000 bytes distance).

Custom datasets

Parse web traffic and SaaS apps for specific data defined in a custom dataset. For sensitivity, canredact/hash data in logs.
● Exact Data Match: Specify most important sets of PII like such as customer names, addresses,
phone numbers, and credit card numbers. All data encrypted before reaching Cloudflare.
● Custom Wordlists: Protect non-sensitive data, such as IP and SKU numbers.

Multimode CASB Capabilities
Risk Visibility and ComplianceAPI-based scanning

Integrate a third-party SaaS apps to scan data-at rest for security findings like misconfigurations,unauthorized user activity, shadow IT, and data security issues that can occur after a user has
successfully logged in. 18+ integrations available (e.g. Microsoft 365, Google Workspace).

Shadow IT discovery

Shadow IT visibility into the SaaS apps and private network origins your end users are visiting.
Review discovered apps and adjust approval status—Approved, Unapproved, In Review, andUnreviewed. Set granular identity and device-driven policies* accordingly.

Audit logging

Comprehensive logging* for all requests, users, and devices. Use logpush* or API to integratewith existing third-party storage or SIEM tools for compliance auditing.

Data Security and Threat Prevention
Zero Trust access*Set least-privilege policies per app via ZTNA to limit user access to data

File sharing controls*

Allow or block file upload/downloads based on MIME type via HTTP SWG policies

App controls*

Allow or block traffic to specific apps or app types via HTTP SWG policies

Tenant controls*

Control traffic SaaS app tenants via SWG to prevent data loss

Browser controls*

Protect data-in-use in a browser by restricting download, upload, copy/paste, keyboard input, andprinting actions within isolated web pages and applications via RBI. Prevent data leakage onto
local devices, and control user inputs on suspicious websites.

DLP scanning*

Scan HTTP traffic via SWG for sensitive data through strings matching the keywords or RegEx
specified in configure DLP profile. Enable DLP profiles in a CASB integration and discover if files
stored in your SaaS apps contain sensitive data. Extend DLP to private apps via clientless RBI
which inherits all HTTP based policies.

*using ZTNA, SWG, and/or RBI capabilities in the SSE & SASE platform
1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-OCT2023

Cloudflare | DLP & CASB

Why Cloudflare?

One unified platform
Secure accessby verifying andsegmenting any
user to any
resource

Threat defense
by covering allchannels with
network-powered
AI/ML & threat intel

Data protection
by increasing
visibility and controlof data in transit, atrest and in use

One programmable network
More effectiveby simplifying
connectivityand policy
management

Ready to discuss your dataprotection needs?
Request Workshop

1.
2.

More productiveby ensuring fast,reliable, andconsistent UX
everywhere

More agile
by innovating rapidly
to meet yourevolving security
requirements

Not quite ready for alive conversation?
Keep learning more
about Cloudflare's
SSE & SASE platform

2023 survey: techvalidate.com/product-research/cloudflare/charts
IBM Cost of Breach Report: https://www.ibm.com/reports/data-breach

1 888 99 FLARE | enterprise@cloudflare.com | Cloudflare.com

REV:PMM-SEPT2023