In this article we talk about Cloudflare IDS, a new Cloudflare product about to launch, whose purpose is to monitor the network and raise an alert in the event of a suspected attack. Deeply integrated into Cloudflare One, the Cloudflare Intrusion Detection System offers an overall view of the global network, inspecting all traffic to detect any malicious behaviour – regardless of whether the suspected attack comes from outside or inside the network.
Cloudflare IDS analyses the network effortlessly
Companies usually create firewall rules to keep their networks safe from external and internal threats. When attackers try to attack a network, those firewalls check whether the attack matches a rule pattern and, if so, the firewall steps in to block the attack.
These rules are usually configured on physical firewalls, often of different makes and models, deployed in physical locations. Cloudflare recently announced Magic Firewall, network-level firewalls delivered from its data centres around the world. With this solution you can write a firewall rule once and deploy it on Cloudflare, so that Cloudflare's global network protects your offices and data centres without the need for on-premises hardware.
But this solution works best when you know where attacks are coming from. If you don't, finding these kinds of attacks becomes expensive. Sophisticated attackers can probe a network's defences to work out which rules do or don't exist, using this information to launch stealthier attacks. Or, worse still, they can "compromise" employees and attack from the inside.
The Cloudflare Intrusion Detection System (IDS), by contrast, provides a (more sophisticated) solution able to analyse the whole network at once, raising alerts for particular events that might not be detected by the rules written.
Cloudflare IDS is a critical piece of Cloudflare One. With WARP connecting devices and Magic Transit connecting offices and data centres to Cloudflare, Cloudflare IDS sits on top of both, making it possible to examine and evaluate all traffic at once. This gives a unique view of what is happening inside the network and where breaches may have occurred. Cloudflare IDS (Cloudflare assures us) is also constantly improving its identification of threats and attacks. You can choose to receive alerts and, with a single click, quickly and easily block intrusion attempts that get past the static rules. More importantly, you can benefit from the intelligence of Cloudflare's system, which learns from attacks in other regions or industries to flag events that affect your system.
How it works
Assume a breach:
Legacy security models implicitly trusted any connection inside the network. This made them vulnerable to breaches and attacks by malicious actors coming from inside. The Zero Trust concept turns the model upside down by assuming that every connection is dangerous. Instead of waiting for proof that a definite breach has occurred, it assumes one already has.
To implement the Zero Trust model effectively, two main components are needed:
- A complete view of the entire network, constantly analysed to spot problems that static rules may have missed
- An intrusion detection system (bought or built in-house) that carries out the analysis.
Part of what drives Cloudflare IDS's effectiveness is its deep integration with Cloudflare One.
WARP and Magic Transit provide the first component, allowing the whole network and all devices to be connected to Cloudflare, giving an overall view of every single packet and connection.
Cloudflare IDS then helps detect attacks coming from any part of the network by actively examining traffic and its content. Cloudflare IDS (as Cloudflare explains) should work in two ways:
- Traffic shape
- Traffic inspection.
By observing the behaviour of traffic on your network, it is possible to learn what normal behaviour looks like. A user normally logs in to a single system each day, only accesses certain applications and so on. You would not expect someone to try to access many systems at once or to scan the network's ports. These are clear signs of bad intentions.
The other form of intrusion detection Cloudflare uses is traffic inspection: it examines network traffic to spot highly targeted attacks. These kinds of attacks cannot be detected using traditional methods because they look like normal traffic. Only by looking inside is it possible to notice whether someone is trying to do something potentially harmful.
Herd immunity
Attackers tend to follow a pattern, repeating the same attack methods on different businesses.
Indeed, an increase in threats of this kind has been observed recently, as attacks such as the "Fancy Bear DDoS campaigns" move from one organisation to another using the same tactics.
Safer together. Cloudflare IDS learns from attacks directed at Cloudflare's own network, but also from those directed at its customers, so as to continuously identify the new types of attack being launched. In this way (Cloudflare explains) it can offer IDS adopters the benefit of the lessons learned in protecting itself and its other customers. The platform also lets you incorporate external threat feeds and upload your own.
Relief for the CPU
A big problem with IDS solutions (whether built in-house or bought) is that they are notoriously CPU-hungry. These solutions need to keep a lot of state in memory and require a lot of computation to work effectively and accurately.
With Cloudflare IDS, built from the ground up to scale indefinitely, you can instead offload this burden onto Cloudflare's network. Every edge data centre runs exactly the same software, allowing the workload to be handled efficiently and at scale. Cloudflare IDS therefore removes the computational load of legacy solutions, reducing concerns about capacity.
Incredibly easy to switch on
Cloudflare assures us that its IDS is extremely easy to activate. Once Cloudflare IDS is deployed, a single click is enough for the system to start analysing Magic Transit traffic patterns and Magic Firewall events and comparing them with its threat feeds.
When something suspicious and threatening happens, an alert will be raised. From then on you can examine the intrusion attempt and establish what happened, getting more information on the type of attack and where it occurred. Remediation is then a click away: you simply set a rule and push it to Cloudflare's global network and (Cloudflare again assures us) the attack will be stopped in its tracks.
