SOLUTION B RI EF

Zero Trust visibility and control ofevery SaaS application

SaaS applications empower yourteams to do more than ever before,
but the flexibility and freedom
they afford your workforce also
introduces security risks, visibility
challenges, and access control
hurdles for your organization.
Cloudflare gives you the tools youneed to protect your data andworkforce while still allowing youremployees to use the tools that
help them get the job done.

UserSaaS App
Shadow IT Discovery

ClientlessAccess

Client onDevice

Router inOffice

Approved
Application Gateway Policy
Zero Trust Access Policy
Tenant Controls

Unapproved

Data Protection Controls

Unreviewed

Discover and control
shadow IT

Apply Zero Trust
access policy

Without visibility into theapplications your employees
are using, you can’t control
how sensitive data is stored,shared, or exposed to thirdparties. Cloudflare helps
you discover, categorize,
and control all approved andunapproved applications
within your organization, while
logging every connection andrequest in one centralized
location.

SaaS applications are hosted
outside of the corporate
network, leaving your security
teams with limited ability tocontrol how users accessthose applications and movedata in and out of them.
Cloudflare layers Zero Trust
security measures in frontof your SaaS applications,authenticating legitimate users
and preventing unauthorizedusers or risky devices fromaccessing your files and data.

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

In Review

Apply tenant and dataprotection controls
When employees access thewrong instance of applications,they can share and store yourdata in the wrong places —opening the door to potential
data leaks and other security
risks. Cloudflare helps you control
the sharing and storage of yourdata, whether it is in transit over
our network or in-use within
our remote browser. Now, youcan build and deploy Zero Trustbrowsing policies to protect
the data that lives within any
SaaS tenant, while keeping youremployees from accessing thewrong applications or the wrong
tenants of approved applications.

Discover and control shadow IT
Evaluate the applications your employees use
When your IT team can’t see the applications your employees are using, they
can’t control what happens to the data within those applications. Cloudflare
aggregates and automatically categorizes all HTTP requests in our activity
log by application type. From there, you can set the status and track theusage of both approved and unapproved apps across your organization.

Key Features•Automatically track
which applications havealready been secured by
Cloudflare•

Retain logs for up to 6
months in Cloudflare’snetwork•Push logs to one or moreof your cloud log storageand SIEM services

Log every connection and request
Cloudflare helps mitigate the risks introduced to your organization whenemployees access unsanctioned applications or use unmanaged devices
to access sensitive information. Every connection and request is logged in
one central location, so you can see which applications are in use and whatactions users are taking within them. Administrators also have the ability
to block and allow requests to SaaS applications, preventing users frombypassing important security controls and gaining unauthorized access toapps, resources, and data across your organization.

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

Apply Zero Trust access policy to your SaaS applications
Provide secure SaaS access through Cloudflare’s identity proxy
SaaS applications are hosted by third parties and often managed bybusiness units, which means your IT team often has little say over how
users access those applications. Cloudflare sits between your identity
provider and your SaaS applications, enabling you to build and apply
identity-aware, context-driven Zero Trust rules to the login process — allwithout disrupting the end-user experience.

Determine application permissions for user devices
Your IT department needs granular control over the way corporatemanaged devices log in to SaaS applications. Cloudflare inserts Zero Trust
rules into the single sign-on process for all applications that support SAML
authentication. Users first authenticate with their identity provider; then,Cloudflare checks the request against device posture and location before
authorizing access to any SaaS app -- with flexible session management
for continuous verification. Security administrators can also create devicespecific policies, so users can only access applications via devices thatmeet pre-established security requirements, including mTLS certificates.

Key Features•Integrate multiple identityproviders or multiple
instances of the sameprovider•

Verify user identity with
per-app rules (e.g. MFA
requires hard key)•

Verify device posture with
per-app rules (e.g. SWG
policy enforced, EPP
installed, mTLS certificate,disk encryption enabled)
and location•

Cloudflare’s app launcher
portal allows users to see
and access all of theirapproved SaaS
applications

Device Postureand Location

SAMLSSO
Users
Identity Providers

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

SaaS Apps

Apply tenant and data protection controls to any
SaaS application
Restrict access to non-corporate instances of applications
Cloudflare enables tenant control through HTTP gateway policies, which
can be configured to prevent users from accessing consumer versions ofapplications. Instead of enforcing these policies using on-premise proxy
servers via corporate VPNs, Cloudflare filters and inspects all traffic andrequests through a vast global network of data centers — so your users
never experience increased latency or degraded performance.

Prevent corporate data from leaving your tenants
Cloudflare makes it easy to build and deploy Zero Trust browsing
policies to control and protect the data that lives within your web-based
applications. All application code is executed in a secure headless browser
running remotely across our massive global network, rather than endpoint
devices, so sensitive data is shielded from compromised or untrusted
devices and zero-day threats. And administrators retain control over
how users access and share that data, so you can minimize the risk ofaccidental data loss or more significant data breaches.

Key Features•Allow or block browser
behaviors basedon multiple criteria,
including application,
application type,
hostname, user identity,and security risk•

Control user actions
within the browser:
download, upload,copy-paste, keyboard
input, and printing
functionalities

Control file down/upload
Block copy/paste & print
Untrusted interactions
can be controlled inheadless browser

Zero Trust drawcommands

User browser

Untrustedinteractions

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

Sensitive data

Any web app

The Cloudflare difference
Built from scratch

Single control pane

Cloudflare’s CASB capabilities
work seamlessly with ourZTNA, SWG, and RBI services
because all are built fromscratch — eliminating theneed to juggle multiple point
products to protect yourapplications and teams.

Cloudflare allows organizations
to set policies and manage
application access and usage
from a single dashboard — so
you can monitor all requests
and permissions at a glance.

Breadth of our platform
Cloudflare places Zero Trust
access (ZTNA), gateway (SWG),
and browser (RBI) controls infront of your SaaS applications— without requiring your ITteam to configure and operate
a dedicated CASB product.

Cloudflare helps teams monitor,
protect, and control SaaS applications
via a natively integrated suite ofZero Trust security capabilities.
Learn more now

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

REV:BDES-2797.2022JAN27