0

The home page for Internet insights: Cloudflare Radar 2.0

Cloudflare Radar was launched two years ago to give everyone access to the Internet trends, patterns and insights Cloudflare uses to help improve our service and protect our customers.

Until then, these types of insights were only available internally at Cloudflare. However, true to our mission of helping build a better Internet, we felt everyone should be able to look behind the curtain and see the inner workings of the Internet. It’s hard to improve or understand something when you don’t have clear visibility over how it’s working.

On Cloudflare Radar you can find timely graphs and visualizations on Internet traffic, security and attacks, protocol adoption and usage, and outages that might be affecting the Internet. All of these can be narrowed down by timeframe, country, and Autonomous System (AS). You can also find interactive deep dive reports on important subjects such as DDoS and the Meris Botnet. It’s also possible to search for any domain name to see details such as SSL usage and which countries their visitors are coming from.

Since launch, Cloudflare Radar has been used by NGOs to confirm the Internet disruptions their observers see in the field, by journalists looking for Internet trends related to Continue reading

0

The status page the Internet needs: Cloudflare Radar Outage Center

Historically, Cloudflare has covered large-scale Internet outages with timely blog posts, such as those published for Iran, Sudan, Facebook, and Syria. While we still explore such outages on the Cloudflare blog, throughout 2022 we have ramped up our monitoring of Internet outages around the world, posting timely information about those outages to @CloudflareRadar on Twitter.

The new Cloudflare Radar Outage Center (CROC), launched today as part of Radar 2.0, is intended to be an archive of this information, organized by location, type, date, etc.

Furthermore, this initial release is also laying the groundwork for the CROC to become a first stop and key resource for civil society organizations, journalists/news media, and impacted parties to get information on, or corroboration of, reported or observed Internet outages.

What information does the CROC contain?

At launch, the CROC includes summary information about observed outage events. This information includes:

• Location: Where was the outage?
• ASN: What autonomous system experienced a disruption in connectivity?
• Type: How broad was the outage? Did connectivity fail nationwide, or at a sub-national level? Did just a single network provider have an outage?
• Scope: If it was a sub-national/regional Continue reading

0

Video: Kubernetes Services Types

Kubernetes services are like networking standards: there are so many to choose from. In his brief introduction to Kubernetes service types, Stuart Charlton listed six of them, and I’m positive there are more. That’s what you get when you’re trying to reinvent every network load balancing method known to mankind ;)

0

Video: Kubernetes Services Types

Kubernetes services are like networking standards: there are so many to choose from. In his brief introduction to Kubernetes service types, Stuart Charlton listed six of them, and I’m positive there are more. That’s what you get when you’re trying to reinvent every network load balancing method known to mankind ;)

0

About a third of cloud users need to learn resiliency lessons from Ian

Beyond the human cost, natural disasters like hurricane Ian can take a high toll on business continuity, causing enterprise-infrastructure damage that takes days or weeks to fix while downtime costs in the six figures per hour. If Ian didn’t impact your operations, now is the time to prepare for a future disaster that might hit your network.Vulnerable areas include cloud providers’ managed services that might require customers to explicitly specify they want their apps, compute, and storage housed in redundant, geographically separate availability zones. According to Uptime Institute, roughly one third of enterprises are architecting cloud apps that are vulnerable to outages in single cloud availability zones, rather than distributing their workloads across multiple zones.To read this article in full, please click here

0

About a third of cloud users need to learn resiliency lessons from Ian

Beyond the human cost, natural disasters like hurricane Ian can take a high toll on business continuity, causing enterprise-infrastructure damage that takes days or weeks to fix while downtime costs in the six figures per hour. If Ian didn’t impact your operations, now is the time to prepare for a future disaster that might hit your network.Vulnerable areas include cloud providers’ managed services that might require customers to explicitly specify they want their apps, compute, and storage housed in redundant, geographically separate availability zones. According to Uptime Institute, roughly one third of enterprises are architecting cloud apps that are vulnerable to outages in single cloud availability zones, rather than distributing their workloads across multiple zones.To read this article in full, please click here

0

About a third of you cloud users need to learn resiliency lessons from Ian

Beyond the human cost, natural disasters like hurricane Ian can take a high toll on business continuity, causing enterprise-infrastructure damage that takes days or weeks to fix at a downtime cost in the six figures per hour. If Ian didn’t get you, now is the time to prepare for a future disaster that might hit your network.Vulnerable areas include cloud providers’ managed services that might require customers to explicitly specify they want their apps, compute, and storage housed in redundant, geographically separate availability zones. According to Uptime Institute, roughly one third of enterprises are architecting cloud apps that are vulnerable to outages in single cloud availability zones, rather than distributing their workloads across multiple zones.To read this article in full, please click here

0

About a third of you cloud users need to learn resiliency lessons from Ian

Beyond the human cost, natural disasters like hurricane Ian can take a high toll on business continuity, causing enterprise-infrastructure damage that takes days or weeks to fix at a downtime cost in the six figures per hour. If Ian didn’t get you, now is the time to prepare for a future disaster that might hit your network.Vulnerable areas include cloud providers’ managed services that might require customers to explicitly specify they want their apps, compute, and storage housed in redundant, geographically separate availability zones. According to Uptime Institute, roughly one third of enterprises are architecting cloud apps that are vulnerable to outages in single cloud availability zones, rather than distributing their workloads across multiple zones.To read this article in full, please click here

0

DNS Evolution: Innovation or Fragmentation?

How should we engage with evolution and innovation in the Internet’s name space? How can we evolve this name environment if we avoid fragmentation and stay within the confines of the incumbent name system? Are all that we are permitted to vary when we try to innovate in the name space are the values of the labels used within DNS names? This was never a satisfactory answer, and many actors have experimented with various forms of alternative name systems running over the Internet for many years. These efforts inevitably result in a fragmented name space. Is there a better way to respond to these conflicting pressures?

0

Kubernetes Unpacked 010: Troubleshooting And Alerting On Kubernetes

In this episode, Michael catches up with Natan Yellin, CEO of Robusta.dev. Michael and Ned chat about how logging and troubleshooting works in Kubernetes today. They discuss three stages of troubleshooting evolution - manual playbooks, automatic playbooks, and the third stage, which is what you do with logs and how automatic remediation can come into play for any Kubernetes environment.

0

Kubernetes Unpacked 010: Troubleshooting And Alerting On Kubernetes

In this episode, Michael catches up with Natan Yellin, CEO of Robusta.dev. Michael and Ned chat about how logging and troubleshooting works in Kubernetes today. They discuss three stages of troubleshooting evolution - manual playbooks, automatic playbooks, and the third stage, which is what you do with logs and how automatic remediation can come into play for any Kubernetes environment.

The post Kubernetes Unpacked 010: Troubleshooting And Alerting On Kubernetes appeared first on Packet Pushers.

0

IBM, Vodaphone, GSMA form group to promote quantum-safe networks

The Global System for Mobile Communications Association (GSMA), IBM and Vodaphone are teaming up to form a task force that will promote quantum-safe cryptography standards for telco networks and, ultimately, enterprise cloud service environments.The idea behind the new group, called the GSMA Post-Quantum Telco Network Taskforce, is to define requirements and create a standards-based roadmap to implement quantum-safe networking and mitigate anticipated security risks.“Telco networks are the underpinning of all enterprise services, regardless of what industry they are in, so it is critical that those networks [get] out in front of the security challenges quantum brings,” said Ray Harishankar, IBM Fellow, vice president, and leader of Big Blue’s Quantum Safe strategy. “The idea of the group is to start to develop a quantum-safe plan now, because the components and standards of that roadmap won’t be developed overnight.”To read this article in full, please click here

0

ITU elects US candidate, quelling concerns about internet fracture

Doreen Bogdan-Martin of the US today defeated Russia’s Rashid Ismailov by a convincing 139 to 25 in a vote to decide who will become the next secretary general of the International Telecommunications Union, allaying Western concerns about nation-state control and interoperability of the internet Bogdan-Martin, who will become the first woman to head the ITU in its 157-year history, is seen by some observers as the candidate most likely to preserve the ITU’s status as a neutral arbiter of a free and open internet, in opposition to recent Russian and Chinese maneuvering in the group that would have placed much more control over the internet’s basic functionality in the hands of nation-states.To read this article in full, please click here

0

MIT-based startup’s cooling tech can cut data center energy costs, footprint

Thanks to innovative cooling technology developed by an MIT-hatched startup, data center managers may soon be able to acquire servers and HPC (high-performance computing) devices that will significantly reduce the energy cost and footprint of the faciities they oversee.The startup, Jetcool, sprang from research conducted at MIT’s Lincoln Labs, and this month received an R&D 100 Award from R&D World magazine, marking it as a standout innovator for its use of what it calls “microconvection” liquid cooling of electronics.To read this article in full, please click here

0

MIT-based startup’s cooling tech can cut data center energy costs, footprint

Thanks to innovative cooling technology developed by an MIT-hatched startup, data center managers may soon be able to acquire servers and HPC (high-performance computing) devices that will significantly reduce the energy cost and footprint of the faciities they oversee.The startup, Jetcool, sprang from research conducted at MIT’s Lincoln Labs, and this month received an R&D 100 Award from R&D World magazine, marking it as a standout innovator for its use of what it calls “microconvection” liquid cooling of electronics.To read this article in full, please click here

0

The (hardware) key to making phishing defense seamless with Cloudflare Zero Trust and Yubico

This post is also available in 简体中文, Français, 日本語 and Español.

Hardware keys provide the best authentication security and are phish-proof. But customers ask us how to implement them and which security keys they should buy. Today we’re introducing an exclusive program for Cloudflare customers that makes hardware keys more accessible and economical than ever. This program is made possible through a new collaboration with Yubico, the industry’s leading hardware security key vendor and provides Cloudflare customers with exclusive “Good for the Internet” pricing.

Yubico Security Keys are available today for any Cloudflare customer, and they easily integrate with Cloudflare’s Zero Trust service. That service is open to organizations of any size from a family protecting a home network to the largest employers on the planet. Any Cloudflare customer can sign in to the Cloudflare dashboard today and order hardware security keys for as low as $10 per key.

In July 2022, Cloudflare prevented a breach by an SMS phishing attack that targeted more than 130 companies, due to the company’s use of Cloudflare Zero Trust paired with hardware security keys. Those keys were YubiKeys and this new collaboration with Yubico, the maker of YubiKeys, removes barriers for Continue reading

0

Click Here! (safely): Automagical Browser Isolation for potentially unsafe links in email

We're often told not to click on 'odd' links in email, but what choice do we really have? With the volume of emails and the myriad of SaaS products that companies use, it's inevitable that employees find it almost impossible to distinguish a good link before clicking on it. And that's before attackers go about making links harder to inspect and hiding their URLs behind tempting "Confirm" and "Unsubscribe" buttons.

We need to let end users click on links and have a safety net for when they unwittingly click on something malicious — let’s be honest, it’s bound to happen even if you do it by mistake. That safety net is Cloudflare's Email Link Isolation.

Email Link Isolation

With Email Link Isolation, when a user clicks on a suspicious link — one that email security hasn’t identified as ‘bad’, but is still not 100% sure it’s ‘good’ — they won’t immediately be taken to that website. Instead, the user first sees an interstitial page recommending extra caution with the website they’ll visit, especially if asked for passwords or personal details.

From there, one may choose to not visit the webpage or to proceed and open it in a remote isolated Continue reading

0

Back in 2017 we gave you Unmetered DDoS Mitigation, here’s a birthday gift: Unmetered Rate Limiting

In 2017, we made unmetered DDoS protection available to all our customers, regardless of their size or whether they were on a Free or paid plan. Today we are doing the same for Rate Limiting, one of the most successful products of the WAF family.

Rate Limiting is a very effective tool to manage targeted volumetric attacks, takeover attempts, bots scraping sensitive data, attempts to overload computationally expensive API endpoints and more. To manage these threats, customers deploy rules that limit the maximum rate of requests from individual visitors on specific paths or portions of their applications.

Until today, customers on a Free, Pro or Business plan were able to purchase Rate Limiting as an add-on with usage-based cost of $5 per million requests. However, we believe that an essential security tool like Rate Limiting should be available to all customers without restrictions.

Since we launched unmetered DDoS, we have mitigated huge attacks, like a 2 Tbps multi-vector attack or the most recent 26 million requests per second attack. We believe that releasing an unmetered version of Rate Limiting will increase the overall security posture of millions of applications protected by Cloudflare.

Today, we are announcing that Free, Pro and Continue reading

0

Now all customers can share access to their Cloudflare account with Role Based Access Controls

Cloudflare’s mission is to help build a better Internet. Pair that with our core belief that security is something that should be accessible to everyone and the outcome is a better and safer Internet for all. Previously, our FREE and PAYGO customers didn’t have the flexibility to give someone control of just part of their account, they had to give access to everything.

Starting today, role based access controls (RBAC), and all of our additional roles will be rolled out to users on every plan! Whether you are a small business or even a single user, you can ensure that you can add users only to parts of Cloudflare you deem appropriate.

Why should I limit access?

It is good practice with security in general to limit access to what a team member needs to do a job. Restricting access limits the overall threat surface if a given user was compromised, and ensures that you limit the surface that mistakes can be made.

If a malicious user was able to gain access to an account, but it only had read access, you’ll find yourself with less of a headache than someone who had administrative access, and could change how your Continue reading

0

How Cloudflare implemented hardware keys with FIDO2 and Zero Trust to prevent phishing

Cloudflare’s security architecture a few years ago was a classic “castle and moat” VPN architecture. Our employees would use our corporate VPN to connect to all the internal applications and servers to do their jobs. We enforced two-factor authentication with time-based one-time passcodes (TOTP), using an authenticator app like Google Authenticator or Authy when logging into the VPN but only a few internal applications had a second layer of auth. That architecture has a strong looking exterior, but the security model is weak. We recently detailed the mechanics of a phishing attack we prevented, which walks through how attackers can phish applications that are “secured” with second factor authentication methods like TOTP. Happily, we had long done away with TOTP and replaced it with hardware security keys and Cloudflare Access. This blog details how we did that.

The solution to the phishing problem is through a multi-factor  authentication (MFA) protocol called FIDO2/WebAuthn. Today, all Cloudflare employees log in with FIDO2 as their secure multi-factor and authenticate to our systems using our own Zero Trust products. Our newer architecture is phish proof and allows us to more easily enforce the least privilege access control.

A little about the terminology of Continue reading