W H I T EPA PER

A Roadmap to Zero
Trust Architecture
Learn the steps, tools, & teams
needed to transform your networkand modernize your security

Content

3

Introduction

4

Components of a Zero Trust Architecture

5-23

The Roadmap to Zero Trust

24-25

Example Implementation Timeline

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

Cloudflare | A Roadmap to Zero Trust Architecture

3

Introduction
Traditional network architecture was built with the concept of a perimeter network
where once someone was on the network, there was an implicit level of trust.
The shift toward cloud hosting, remote work and other modernization has createdchallenges with a traditional perimeter network architecture.
These challenges can be addressed by implementing a Zero Trust Architecture, which
ensures that all traffic in and out of a business is verified and authorized. Implementinga Zero Trust Architecture can be done in steps without disrupting employee productivity
and connectivity.
This guide was built by security experts to provide a vendor agnostic Zero Trustarchitecture and example implementation timeline. The timeline assumes that anorganization is beginning their Zero Trust journey from scratch, but is meant to be
useful for all organizations.
There are seven major components to organizational security that need to beconsidered when it comes to implementing a comprehensive Zero Trust Architecture.
Your implementation order does not need to match how they are listed in thecomponent and reference architecture sections below.

Internet Traffic

Users

Applications
Steady State

Endpoint & Devices

Networks

Data Loss Prevention & Logging

Cloudflare | A Roadmap to Zero Trust Architecture

Components of a Zero Trust
Architecture
Component
Phase 1

Phase 2Phase 3Phase 4

Goal

4

Level
of Effort

Page

Internet traffic

Deploy global DNS filtering

9

Applications

Monitor inbound emails and filter out phishing attempts

13

DLP & logs

Identify misconfig and publicly shared data in SaaS tools

20

Users

Establish corporate identity

5

Users

Enforce basic MFA for all applications

6

Applications

Enforce HTTPS and DNSsec

17Internet traffic

Block or isolate threats behind SSL

9-10

Applications

ZT policy enforcement for publicly addressable apps

14-16

Applications

Protect applications from layer 7 attacks

16

Networks

Close all inbound ports open to the Internet for app delivery

12

Applications

Inventory all corporate applications

13-14

Applications

ZT policy enforcement for SaaS applications

14-16

Networks

Segment user network access

11

Applications

ZTNA for critical privately addressable applications

14-16

Devices

Implement MDM/UEM to control corporate devices

7

DLP & logs

Define what data is sensitive and where it exists

18-19

Users

Send out hardware based authentication tokens

6

DLP & logs

Stay up to date on known threat actors

21

Users

Enforce hardware token based MFA

6Applications

ZT policy enforcement and network access for all applications

14-16

DLP & logs

Establish a SOC for log review, policy updates and mitigation20

Devices

Implement endpoint protection

7

DevicesInventory all corporate devices, APIs and services

8

Networks

Use broadband Internet for branch to branch connectivity

11-12

DLP & logs

Log and review employee activity on sensitive apps

18

DLP & logs

Stop sensitive data from leaving your applications

19

Steady state

DevOps approach for policy enforcement of new resources

22

Steady state

Implement auto-scaling for on-ramp resources

22-23

Here is how we define different levels of effort required for each step:•- Small effort; this can be done by an individual or small team•- Medium effort; this will require a team and advanced preparation•- Large effort; this will require multiple teams and a project planCloudflare | A Roadmap to Zero Trust Architecture

The Roadmap to Zero Trust
Users
Users include employees, contractors and customers. To implement Zero Trust, an organizationmust first have an accurate picture of who should actually be trusted, and with what — otherwise
known as Identity. Then it must establish a way to securely authenticate the identity of its users.
Establish a corporate Identity
Level of effort

Team(s) involved

Product(s)- Medium effort•

The team responsible for your identity provider(typically security or IT)•

The admins who manage internal apps used by employees
and partners

Microsoft Azure AD, Okta, Ping Identity PingOne, OneLogin
A unified corporate identity is required to accurately authenticate
and authorize user access to corporate applications. A consistentcorporate Identity will make granular policy enforcement for yourapplications more seamless.

Summary

Additional points to consider:•Is your company active in M&A? How will you consolidate
identity stores?

•

Do you have any non-web based authentication protocols in use(e.g. active directory, ntml, kerberos)

1.
Steps

Add all corporate users to the identity provider
a. These values can often be synchronized from an
HR system like Workday, ADP, etc
2. Verify that each user’s information is correct
3. Send new users registration information to set up login
credentials

5Cloudflare | A Roadmap to Zero Trust Architecture

Enforce multi-factor authentication for all applications- Small effort (if applying basic MFA)
- Medium effort (if using hard keys)

Level of effort

Team(s) involved•

The team responsible for your identity provider(typically security or IT)•

The admins who manage internal apps used by employees andpartners

Identity providers: Microsoft Azure AD, Okta, Ping Identity PingOne,
OneLogin
Product(s)Application Reverse Proxies: Microsoft Azure AD App Proxy, Akamai
EAA, Cloudflare Access, Netskope Private Access, Zscaler Private
Access (ZPA)
Hard Keys: Yubico

Summary

Multi-Factor Authentication (MFA) is the best protection against
stolen user credentials via phishing or data leaks. Most MFA can be
enabled directly in an IdP.
For applications not directly integrated with your IdP consider using
an Application Reverse Proxy in front of the application to enforce
MFA.
1.

Steps

2.
3.
4.
5.

Alert internal users to upcoming MFA enforcement. Provide
options to sign up for SMS or App-based authenticators
Enable MFA in your IdP
Enable Application Reverse Proxy in front of applications not
integrated with your IdP(Bonus) Distribute Hardware keys to employees via Mail or In
Person distribution(Bonus) Enforce Hardware key only MFA for your most sensitive
applications

6

Cloudflare | A Roadmap to Zero Trust Architecture

Endpoints & Devices
Endpoints and Devices include any device, API or software service within an organization or thathave access to organizational data. Organizations must first understand their full set of devices,
APIs and services. Then Zero Trust policies can be implemented based on the context of thedevice, API and service.
Implement mobile device management
Level of effort
Team(s) involved- Medium effort•

IT Team

Product(s)Mac: Jamf, Kandji Windows: Microsoft Intune

Summary

Majority of Zero Trust architecture requires software to be installedon at least a subset of user machines. Mobile Device Management(MDM) is how most organizations manage the software andconfiguration across their inventory of user devices.

Steps

See MDM Vendor site for specific details.

Implement endpoint protection
Level of effort

Team(s) involved- Medium effort••

Security team
IT Team

Product(s)VMWare Carbon Black, Crowdstrike, SentinelOne,
Windows Defender

Summary

Endpoint protection software is installed on a user’s machine andscans for known threats that affect devices. Endpoint protection
software can also be used to enforce compliance of OS patches andupdates. The signal from your Endpoint Protection software can andshould be used in your Application access control policies.
1.

Steps

Install the Endpoint Protection Software on users’ machines
using MDM
2. Enable threat protection and compliance control in the Endpoint
Protection platform

7

Cloudflare | A Roadmap to Zero Trust Architecture

Inventory devices, APIs and services
Level of effort

Team(s) involved

Product(s)Summary

Steps- Small effort••

Security team
IT TeamDevice Inventory: VMWare Carbon Black, Crowdstrike, SentinelOne,
Windows Defender, Oomnitza
API/Service inventory: Cloudflare application connector, Zscaler
Private Access (ZPA)
Endpoint protection software and asset management software canbe used to track all devices that have been distributed to users. An
accurate list of devices should be maintained to track which devices
are valid and should have access to specific applications.
APIs and services should also be detected and maintained in an
inventory. Network scanning can be leveraged to identify newly
seen APIs and software services that can communicate over aninternal or external network.
1.

Install the Endpoint Protection Software on users’ machines
using MDM
2. Install the API/Service scanner within your network

8

Cloudflare | A Roadmap to Zero Trust ArchitectureInternet Traffic
Internet Traffic includes all user traffic destined for websites outside of an organization’s control.
This can range from business related tasks to personal website usage. All outbound traffic issusceptible to malware and malicious sites. An organization must establish visibility and control
over user traffic destined for the Internet.
Block DNS requests to known threats or risky destinations
Level of effort

Team(s) involved- Small effort••

IT team with access to either router or machine configuration
Security teamProduct(s)DNS Filtering: Cisco Umbrella DNS, Cloudflare Gateway, DNSFilter,
Zscaler Shift

Summary

DNS filtering can be applied via router configuration or directly on
a user machine. It is one of the fastest ways to protect users fromknown malicious websites.

Steps

DNS Filtering: Update DNS resolution configuration on your officewifi to point to the appropriate DNS resolution service. This can beused to block known malicious sites.

Block or isolate threats behind SSL/TLS
Level of effort

Team(s) involved

Product(s)- Medium effort••

IT team with access to either router or machine configuration
Security teamTLS Decryption: Cloudflare Gateway, Netskope Next Gen SWG,
Zscaler Internet Access (ZIA)
Browser Isolation: Cloudflare Browser Isolation, Zscaler CloudBrowser Isolation

9

Cloudflare | A Roadmap to Zero Trust Architecture

Block or isolate threats behind SSL/TLS (continued)

Summary

Some threats are hidden behind SSL and cannot be blocked throughonly HTTPS inspection. To further protect users, TLS decryption
should be leveraged to further protect users from threats behind SSL.
TLS decryption:
1.

Steps

Ensure the correct client software is installed on a user machinea. Check for any VPN or other software that mightinterfere with the outbound web traffic on the device
2. Configure the root certificate on the device for TLS decryption
3. Enable policies of when to avoid decrypting user traffic
a. This should be done for sites that use certificate pinningb. Some companies also bypass decryption for user’s
personal traffic (e.g banking, social media, etc)
Browser Isolation:
1.

Browser isolation can be deployed via the on-device client
software or via an isolation link. Both approaches should beconsidered.

10Cloudflare | A Roadmap to Zero Trust Architecture

Networks
Networks include all public, private and virtual networks within an organization. Organizations
must first understand their existing set of networks and segment them to prevent lateral
movement. Then, Zero Trust policies can be created that granularly control which segments of a
network that users, endpoint and devices can access.
Segment user network access
Level of effort

Team(s) involved- Large effort••

Security team
IT Team

Product(s)Zero Trust Network Access (ZTNA): Cloudflare Zero Trust (Accessand Gateway used together), Netskope Private Access, Zscaler
Private Access (ZPA)

Summary

Users can generally access an entire private network using a VPN
or while in the office network. A Zero Trust framework requiresthat users only have access to specific segments of the network
required to complete a given task. Zero Trust Network solutions
allow users to access a local network remotely but, with granular
policies based on user, device and other factors.
1.

Steps

Make the private network available to the ZTNA
a. Typically an application connector, GRE or IPSec Tunnel
2. Install the ZTNA client on user devices using MDM
3. Set policies to segment user access across the private network

Use broadband Internet for branch to branch connectivity
Level of effort

Team(s) involved

Product(s)- Large effort••

Network engineering team
IT TeamCloudflare Magic WAN, Cato Networks, Aryaka FlexCore

11

Cloudflare | A Roadmap to Zero Trust Architecture

Use broadband Internet for branch to branch connectivity (continued)

Summary

Connectivity between private network locations (eg. data centersand branches) has generally been established using Multi-Protocol
Label Switching (MPLS) lines or other forms of private links offeredby telecom providers. These MPLS links are typically expensive, andas commodity Internet has become higher quality, organizations canprovide the same level of secure access by routing traffic over theInternet via secure tunnels at a fraction of the cost.
1.
2.

Steps

3.

4.
5.
6.

Choose two MPLS-connected locations to start with. These
locations will need some form of Internet connectivity.
Establish a pair of redundant Anycast GRE or IPsec tunnels overyour Internet circuits to your cloud WAN provider’s edge network.
Verify health and connectivity between those tunnels. Test
performance (throughput, latency, packet loss, jitter) of traffic
workloads as similar as possible to production traffic.
Change routing policies to migrate production traffic from MPLS
to Internet tunnels
Repeat at next MPLS-connected location
Decommission MPLS circuits

Close all inbound ports open to the Internet for application delivery
Level of effort
Team(s) involved- Small effort•

Network engineering teamProduct(s)Zero Trust Reverse Proxies: Akamai EAA, Cloudflare Access,Netskope, Zscaler Private Access (ZPA)

Summary

Open inbound network ports can be found using scanningtechnology and are a common attack vector. Zero Trust Reverse
Proxies allow you to securely expose a web application without
opening any inbound ports. The DNS record of the application is the
only publicly visible record of the application. And the DNS record
is protected with Zero Trust policies. As an added layer of security,internal/private DNS can be leveraged using a Zero Trust Network
Access service (more details below).
1.

Steps

Install Reverse Proxy application connector — typically a daemon
or virtual machine somewhere in the same network
2. Connect the Reverse Proxy Application to the application
connector
3. Close all inbound port on the private network with a firewall rule12

Cloudflare | A Roadmap to Zero Trust Architecture

Applications
Applications include any resource where organizational data exists or business processes are
performed. Organizations must first understand the applications that exist and then establish
Zero Trust policies for each application or, in some cases, block unapproved applications.
Monitor email applications and filter out phishing attempts
Level of effort

Team(s) involved

Product(s)Summary- Small effort•

The team responsible for your email provider configuration(typically IT)

Cloud Email Security: Cloudflare Area 1 Email Security, Mimecast,
TitanHQ
Browser Isolation: Cloudflare Browser Isolation, Zscaler CloudBrowser Isolation
Email is one of the few communications channels that attackers
have unfettered access to your employees. Deploying a secure
email gateway is a critical step to ensure that malicious or untrusted
emails do not reach your employees. Additionally, security teams
should consider an option to quarantine links in an isolated browserthat are not suspicious enough to completely block.
1.

Steps

Configure your domain’s MX records to point to the secure email
gateway service
2. Monitor for false positives in the first few weeks
3. (Bonus) implement a link based browser isolation approach forborderline suspicious email links.

Inventory all corporate applications
Level of effort
Team(s) involved

Product(s)- Medium effort•

Security Team

Secure Web Gateway and CASBs with Shadow IT discovery:
Cloudflare Gateway, Microsoft Defender for Cloud Apps, Netskope
Next Gen SWG, Zscaler Internet Access (ZIA)

13

Cloudflare | A Roadmap to Zero Trust Architecture

Inventory all corporate applications (continued)

Summary

Steps

It is critical for a security team to understand their full inventory of
applications used across the business. Often referred to as “Shadow
IT” security teams will often discover unsanctioned or unknown
applications being used across the business. A Secure Web
Gateway with TLS decryption can be used to identify applications.
The Secure Web Gateway can also be used to block unapproved
applications or tenants of applications (e.g. personal Dropbox
accounts).
1.
2.
3.
4.
5.

Enable Shadow IT scanning in the Secure Web Gateway
Ensure the Secure Web Gateway client is installed on user devices
Allow 2-3 weeks of traffic from users
Review the list of identified applications
Any unapproved applications should be blocked with Secure Web
Gateway policies
6. Approved applications should be protected with Zero Trust policies

Zero Trust policy enforcement for applications- Small effort (for most critical applications)- Large effort (for all applications)Level of effort

Team(s) involved•••

Security teamApplication development team
IT teamZero Trust Reverse Proxies: Azure App Proxy, Cloudflare Access,Netskope Private Access, Zscaler Private Access (ZPA)

Product(s)Zero Trust Network Access (ZTNA): Cloudflare Access, Netskope
Private Access, Zscaler Internet Access (ZIA)
CASB: Cloudflare CASB, Netskope CASB, Zscaler CASB
Remote Browser Isolation: Cloudflare Browser Isolation, Zscaler
Cloud Browser Isolation

14

Cloudflare | A Roadmap to Zero Trust Architecture

Zero Trust policy enforcement for applications (continued)

Summary

Applications must be protected with Zero Trust policies thatconsider a user identity, device and network context before
authenticating and authorizing access. Applications shouldhave granular policies that enforce least privilege, especially for
applications that contain sensitive data. There are three major
application types and the Zero Trust security model varies for each
type. The major application types are:1.

Private self-hosted applications (addressable only on thecorporate network)
2. Public self-hosted applications (addressable over the Internet)
3. SaaS applications
Note: If device context or compliance status is a required security
policy then typically on-device client software is required.
Private Self-Hosted Applications
1.

Build an encrypted tunnel between the application andZero Trust policy layer. Typically this will be an “application
connector”, GRE or IPSec tunnel
2. Make the private DNS resolver available for users of the ZTNA
device client
3. Build policies based on user, device and network context toestablish who can access the application
Public Self-Hosted Applications
1.

Steps

Move the authoritative DNS or a CNAME record to theApplication Reverse Proxy
2. Ensure all inbound ports for closed for the application’s network
3. Build policies based on user, device and network context toestablish who can access the application
SaaS Applications
There are a few different options to enforce Zero Trust policies for
SaaS applications
Identity Proxy
Cloudflare, Netskope, and Zscaler provide Identity Proxies thatallow the same policy enforcement as a reverse proxy self hosted
application. This does require that the Identity Proxy is set up as the
SSO provider of the SaaS application
1. Remove the existing SSO integration to the SaaS app, if present
2. Integrate the Identity proxy with the SaaS application
3. Ensure the correct SAML attributes are sent for user creation
and updates
4. Create policies based on the user, device and network context

15

Cloudflare | A Roadmap to Zero Trust Architecture

Zero Trust policy enforcement for applications (continued)
Secure Web Gateway and Single Sign On
The other approach is to use an existing Single Sign On provider tocontrol which users can and cannot access the SaaS application.
Then the Secure Web Gateway, with a dedicated IP address, can beused to ensure that only users from managed devices with traffic
inspection can access the SaaS application.
Steps

1. Add the SaaS application to the SSO provider
2. Create policies to enforce which users are authorized
3. Add the IP address of the Secure Web Gateway instance to the
SaaS application’s IP Allow List (most SaaS apps support IP
allowlists in their base security settings)
4. Create Secure Web Gateway policies that control which users canaccess the SaaS application

Protect applications from Layer 7 attacks (DDoS, injection, bots, etc)
Level of effort

Team(s) involved- Small effort••

Security teamApplication development teamProduct(s)Akamai, AWS, Azure, Cloudflare, GCP

Summary

Any self-hosted application is susceptible to Layer 7 attacks
including DDoS, Code Injection, Bots and more. Security teams
should deploy a Web Application Firewall and DDoS protection
in front of all self-hosted applications, privately and publicly
addressable.

Steps

1. Add any public application’s authoritative DNS record
2. Enable the Web Application Firewall and DDoS protection

16

Cloudflare | A Roadmap to Zero Trust Architecture

Enforce HTTPS and DNSsec
Level of effort

Team(s) involved- Small effort••

Security teamApplication development teamProduct(s)Akamai, AWS, Azure, Cloudflare, GCP

Summary

Any self-hosted web application should leverage HTTPS andDNSSec. This prevents any potential for packet sniffing or domain
hijacking.

Steps

1. Add any public application’s authoritative DNS record
2. Set HTTPS to strict and enable DNSSEC

17

Cloudflare | A Roadmap to Zero Trust Architecture

Data Loss Prevention & Logging
Once you have established all the Zero Trust elements of your architecture to this point, yourarchitecture will be generating large volumes of data on what’s happening inside your network.
At this point, it’s time to implement Data Loss Prevention and Logging. These are a set ofprocesses and tools that focus on keeping sensitive data inside of a business and flagging
any potential opportunities for data leakage. Organizations must first understand where their
sensitive data exists. Then they can establish Zero Trust controls to block sensitive data being
accessed and exfiltrated.
Establish a process to log and review traffic on sensitive applications
Level of effort
Team(s) involved

Product(s)Summary- Medium effort•

Security team

Secure Web Gateway (SWG): Cisco Umbrella, Cloudflare Gateway,
Netskope Next Gen SWG, Zscaler Internet Access (ZIA)
Security Incident and Event Monitoring (SIEM):
DataDog, Splunk, SolarWinds
Secure web gateway solutions have functionality to pass user
traffic logs to a SIEM tool. A security team should make it a regularexercise to review traffic logs destined for sensitive applications.
Specific alerts for anomalous or malicious traffic can be set up andtuned over time in the SIEM.
1.

Steps

Ensure all user traffic destined to sensitive applications is
proxied using the SWG
2. Enable the log push or pull functionality between your SWG and
SIEM
3. Set a specific interval for the security team to review traffic logs
4. Configure alerts in the SIEM based on findings over time

Define what data is sensitive and where it exists
Level of effort

Team(s) involved

Product(s)- Medium effort••

Security teamCompliance/Legal team

Security Incident and Event Monitoring (SIEM):
DataDog, Splunk, SolarWinds

18

Cloudflare | A Roadmap to Zero Trust Architecture

Define what data is sensitive and where it exists (continued)

Summary

Sensitive data varies widely depending on industry. Technology
companies are concerned about protecting source code while
medical providers are heavily focused on HIPAA compliance. It is
important to establish what sensitive data is for your company andwhere it lives.
An accurate definition and inventory of sensitive data will inform theimplementation of Data Loss Prevention tools.

Steps

1.

Review traffic logs in the SIEM tools or directly in a Secure Web
Gateway to identify target applications and data stores
2. Take an inventory of existing sensitive data

Prevent sensitive data from leaving your applications
Level of effort

Team(s) involved- Large effort•••

Security team
IT TeamCompliance/Legal teamProduct(s)In-line Data Loss Prevention (DLP): Cisco Umbrella, Cloudflare
Gateway, Netskope Next Gen SWG, Zscaler Internet Access (ZIA)

Summary

In-line DLP solutions inspect user traffic and file uploads/downloads
for sensitive data. The sensitive data is available in well known
predefined lists (e.g. PII, SSNs, Credit Cards, etc) or specificpatterns can be manually configured by an administrator. DLP
controls should be enabled for sensitive applications and can be
expanded for all user traffic.

Steps

1. Install the client software from the DLP provider
2. Ensure there is no existing VPN or other tool that will
disrupt connectivity
3. Ensure TLS decryption is enabled and a root certificate ispresent on each user machine
4. Enable DLP controls
5. Monitor for DLP block events and verify if it is valid ora false positive19

Cloudflare | A Roadmap to Zero Trust Architecture

Identify misconfigurations and publicly shared data in SaaS tools
Level of effort
Team(s) involved- Small effort•

Security teamProduct(s)API based Cloud Access Security Broker (CASB): Cloudflare CASB,
DoControl, Netskope, Zscaler CSPM

Summary

CASBs integrate with major SaaS applications via an API integration.
The CASB will then scan the SaaS application for known security
misconfiguration and data that has been publicly shared. A security
team should establish a regular cadence to review CASB findings.
1.

Steps

Connect each SaaS application via the provider’s API
integration instructions
2. Run scans for each SaaS application
3. Review the scan results and begin remediation in each
SaaS application where appropriate

Establish a Security Operations Center (SOC) for log review, policy updates and mitigation
Level of effort
Team(s) involved- Medium effort•

Security teamProduct(s)NoneSummary

A SOC is a critical function within a security team in a Zero Trustframework. It should focus on reviewing log information and security
alerts and adjusting Zero Trust policies across all core security
products.

Steps

1. Review logs in SIEM or directly in security product2. Identify any alerts or anomalous activity
3. Update Zero Trust policies across each tool based on findings

20

Cloudflare | A Roadmap to Zero Trust Architecture

Stay up to date on known threat actors
Level of effort
Team(s) involved- Small effort•

Security teamProduct(s)Threat intelligence providers: Cloudflare Radar, CISA, OWASPSummary

There are multiple providers focused on compiling a list of known
threat actors and malicious websites. These threat feeds can be
automatically loaded into a Secure Web Gateway to protect users
from attacks.

Steps

1. Connect threat feed into Secure Web Gateway
2. Enable threat protection in DNS and HTTP filtering

21

Cloudflare | A Roadmap to Zero Trust Architecture

Steady State
Once you have built out your Zero Trust architecture for all the other elements of yourorganization, there are a set of actions you can take to move your organization to a Zero Trust
steady state, ensuring consistency with the architecture moving forward.
Employ a DevOps approach to ensure consistent policy enforcement for all new resources
Level of effort

Team(s) involved- Large effort••

Security teamApplication development teamProduct(s)Infrastructure automation: Ansible, Puppet, Terraform

Summary

Infrastructure automation tools allow developers to automatically
deploy Zero Trust security as part of their application development
pipeline. Establish internal testing that will trigger if an application is
deployed with Zero Trust Reverse Proxy protection.

Steps

1. Define a standard policy for new applications
2. Add tests in the application deployment process that require
Zero Trust Reverse Proxy protection

Implement auto-scaling for on-ramp resources
Level of effort

Team(s) involved

Product(s)- Large effort••

Security teamApplication development teamLoad balancers: Akamai, Cloudflare
Infrastructure automation: Ansible, Puppet, Terraform22

Cloudflare | A Roadmap to Zero Trust Architecture

Implement auto-scaling for on-ramp resources (continued)

Summary

Load balancers can be effective tools to ensure individual
application infrastructure is never overloaded. As well as providing alevel of redundancy if one application server began to fail.
Infrastructure automation tools can be used to spin up new
resources if specific traffic thresholds are crossed.
1.

Steps

Configure a load balancer in front of Zero Trust Reverse Proxy
Application connector
2. Enable load balancing rules based on traffic volumes and/or
geo-location of users.
3. Implement infrastructure automation policies that will provision
new virtual machines if sufficient load is generated for a specific
set of applications

23

Cloudflare | A Roadmap to Zero Trust Architecture

24

Example Implementation Timeline
Every Zero Trust Architecture deployment is unique but there are a common set of steps thatmost projects follow. This is a recommended timeline for a business getting started on a Zero
Trust Architecture implementation.
Timeline

Goal

Relevant Products

Phase 1

Deploy global DNS filtering

Cisco Umbrella DNS, Cloudflare Gateway, DNSFilter,
Zscaler ShiftMonitor inbound emails and filter out
phishing attempts

Phase 2Cloud Email Security: Cloudflare Area 1 Email Security,
Mimecast, TitanHQ
Browser Isolation: Cloudflare Browser Isolation, Zscaler
Cloud Browser Isolation

Identify misconfig and publicly shareddata in SaaS tools

Cloudflare CASB, DoControl, Netskope, Zscaler CSPM

Establish corporate identity

Microsoft Azure AD, Okta, Ping Identity PingOne,
OneLogin
Identity providers: Microsoft Azure AD, Okta, Ping Identity
PingOne, OneLogin

Enforce basic MFA for all applications

Enforce HTTPS and DNSsec

Block or isolate threats behind SSL

Phase 3

Application Reverse Proxies: Microsoft Azure AD App
Proxy, Akamai EAA, Cloudflare Access, Netskope Private
Access, Zscaler Private Access (ZPA)
Akamai, AWS, Azure, Cloudflare, GCP
TLS Decryption: Cloudflare Gateway, Netskope Next Gen
SWG, Zscaler Internet Access (ZIA)
Browser Isolation: Cloudflare Browser Isolation, Zscaler
Cloud Browser Isolation

ZT policy enforcement for publicly
addressable apps

Zero Trust Reverse Proxies: Azure App Proxy, Cloudflare
Access, Netskope Private Access, Zscaler Private Access(ZPA)

Protect applications from layer 7 attacks

Akamai, AWS, Azure, Cloudflare, GCP

Close all inbound ports open to theInternet for app delivery

Akamai EAA, Cloudflare Access, Netskope, Zscaler Private
Access (ZPA)

Inventory all corporate applications

Secure Web Gateway and CASBs with
Shadow IT discovery: Cloudflare Gateway, Microsoft
Defender for Cloud Apps, Netskope Next Gen SWG,
Zscaler Internet Access (ZIA)

ZT policy enforcement for SaaS
applications

Zero Trust Network Access (ZTNA): Cloudflare Access,Netskope Private Access, Zscaler Internet Access (ZIA)
CASB: Cloudflare CASB, Netskope CASB, Zscaler CASBCloudflare | A Roadmap to Zero Trust Architecture

Phase 425

Segment user network accessZero Trust Network Access (ZTNA): Cloudflare Zero Trust(Access and Gateway used together), Netskope Private
Access, Zscaler Private Access (ZPA)

ZTNA for critical privately
addressable applications

Cloudflare Access, Netskope Private Access, Zscaler
Internet Access (ZIA)

Implement MDM/UEM to control
corporate devices

Mac: Jamf, Kandji Windows: Microsoft Intune

Define what data is sensitive andwhere it exists

DataDog, Splunk, SolarWinds

Send out hardware based authentication
tokensHard Keys: Yubico

Stay up to date on known threat actors

Cloudflare Radar, CISA, OWASPEnforce hardware token based MFA

Hard Keys: Yubico

ZT policy enforcement and network
access for all applications

Cloudflare Access, Netskope Private Access, Zscaler
Internet Access (ZIA)

Establish a SOC for log review, policy
updates and mitigation

N/A

Implement endpoint protection

VMWare Carbon Black, Crowdstrike, SentinelOne,
Windows Defender

Inventory all corporate devices, APIs
and services

Use broadband Internet for branch tobranch connectivity

Establish a process to log and review
employee activity on sensitive
applications

Device Inventory: VMWare Carbon Black, Crowdstrike,
SentinelOne, Windows Defender, Oomnitza
API/Service inventory: Cloudflare application connector,
Zscaler Private Access (ZPA)
Cloudflare Magic WAN, Cato Networks, Aryaka FlexCore
Secure Web Gateway (SWG): Cisco Umbrella, Cloudflare
Gateway, Netskope Next Gen SWG, Zscaler Internet
Access (ZIA)
Security Incident and Event Monitoring (SIEM):
DataDog, Splunk, SolarWinds

Stop sensitive data from leaving yourapplications (e.g. PII, Credit Cards,
SSNs, etc)

Cisco Umbrella, Cloudflare Gateway, Netskope Next Gen
SWG, Zscaler Internet Access (ZIA)

Employ a DevOps approach to ensure
policy enforcement for all new resources

Ansible, Puppet, Terraform

Implement auto-scaling for on-ramp
resources

Load balancers: Akamai, Cloudflare
Infrastructure automation: Ansible, Puppet, Terraform© 2022 Cloudflare Inc. All rights reserved. The
Cloudflare logo is a trademark of Cloudflare.
All other company and product names may be
trademarks of the respective companies withwhich they are associated.

1 888 99 FLARE | enterprise@cloudflare.com | www.cloudflare.com

REV:BDES-3584.2022AUG09