Cloudflare Zero Trust: Building Modern Security Architecture Without VPNs#

1
# Dockerfile for cloudflared
2
FROM cloudflare/cloudflared:latest
3
COPY config.yml /etc/cloudflared/config.yml
4
COPY tunnel-credentials.json /etc/cloudflared/creds.json
5
CMD ["tunnel", "--config", "/etc/cloudflared/config.yml", "run"]

1
// Access policy configuration via API
2
const axios = require('axios');
3

4
const CF_ACCOUNT_ID = process.env.CF_ACCOUNT_ID;
5
const CF_API_TOKEN = process.env.CF_API_TOKEN;
6

7
async function createAccessApplication() {
8
  const application = {
9
    name: "Internal Dashboard",
10
    domain: "dashboard.example.com",
11
    type: "self_hosted",
12
    session_duration: "24h",
13
    allowed_idps: ["azure-ad"],
14
    auto_redirect_to_identity: true,
15
    enable_binding_cookie: true,
16
    http_only_cookie_attribute: true,
17
    same_site_cookie_attribute: "lax",
18
    logo_url: "https://example.com/logo.png",
19
    app_launcher_visible: true,
20
    service_auth_401_redirect: true
21
  };
22

23
  const response = await axios.post(
24
    `https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/access/apps`,
25
    application,
26
    {
27
      headers: {
28
        'Authorization': `Bearer ${CF_API_TOKEN}`,
29
        'Content-Type': 'application/json'
30
      }
31
    }
32
  );
33

34
  return response.data.result;
35
}
36

37
async function createAccessPolicy(appId) {
38
  const policy = {
39
    name: "Engineering Team Access",
40
    decision: "allow",
41
    precedence: 1,
42
    include: [
43
      {
44
        group: {
45
          id: "engineering-group-id"
46
        }
47
      },
48
      {
49
        email_domain: {
50
          domain: "example.com"
51
        }
52
      }
53
    ],
54
    exclude: [
55
      {
56
        email: {
57
          email: "contractor@external.com"
58
        }
59
      }
60
    ],
61
    require: [
62
      {
63
        device_posture: {
64
          integration_uid: "device-trust-uid"
65
        }
66
      },
67
      {
68
        geo: {
69
          country_code: ["US", "GB", "DE"]
70
        }
71
      }
72
    ]
73
  };
74

75
  const response = await axios.post(
76
    `https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/access/apps/${appId}/policies`,
77
    policy,
78
    {
79
      headers: {
80
        'Authorization': `Bearer ${CF_API_TOKEN}`,
81
        'Content-Type': 'application/json'
82
      }
83
    }
84
  );
85

86
  return response.data.result;
87
}

1
// Service-to-service authentication
2
const jwt = require('jsonwebtoken');
3
const axios = require('axios');
4

5
class CloudflareServiceAuth {
6
  constructor(clientId, clientSecret) {
7
    this.clientId = clientId;
8
    this.clientSecret = clientSecret;
9
    this.token = null;
10
    this.tokenExpiry = null;
11
  }
12

13
  async getToken() {
14
    if (this.token && this.tokenExpiry > Date.now()) {
15
      return this.token;
16
    }
17

18
    const response = await axios.post(
19
      'https://example.cloudflareaccess.com/cdn-cgi/access/get-identity',
20
      {},
21
      {
22
        headers: {
23
          'CF-Access-Client-Id': this.clientId,
24
          'CF-Access-Client-Secret': this.clientSecret
25
        }
26
      }
27
    );
28

29
    this.token = response.headers['cf-access-token'];
30
    const decoded = jwt.decode(this.token);
31
    this.tokenExpiry = decoded.exp * 1000;
32

33
    return this.token;
34
  }
35

36
  async makeAuthenticatedRequest(url, options = {}) {
37
    const token = await this.getToken();
38

39
    return axios({
40
      ...options,
41
      url,
42
      headers: {
43
        ...options.headers,
44
        'CF-Access-Token': token
45
      }
46
    });
47
  }
48
}
49

50
// Usage
51
const serviceAuth = new CloudflareServiceAuth(
52
  process.env.CF_SERVICE_CLIENT_ID,
53
  process.env.CF_SERVICE_CLIENT_SECRET
54
);
55

56
const response = await serviceAuth.makeAuthenticatedRequest(
57
  'https://api.example.com/data'
58
);

1
# Python script for managing Gateway DNS policies
2
import requests
3
import json
4

5
class CloudflareGateway:
6
    def __init__(self, account_id, api_token):
7
        self.account_id = account_id
8
        self.api_token = api_token
9
        self.base_url = f"https://api.cloudflare.com/client/v4/accounts/{account_id}"
10
        self.headers = {
11
            "Authorization": f"Bearer {api_token}",
12
            "Content-Type": "application/json"
13
        }
14

15
    def create_dns_policy(self, name, traffic, rule_settings):
16
        """Create DNS filtering policy"""
17
        policy = {
18
            "name": name,
19
            "description": f"DNS policy for {name}",
20
            "action": "block",
21
            "enabled": True,
22
            "traffic": traffic,
23
            "rule_settings": rule_settings,
24
            "precedence": 1
25
        }
26

27
        response = requests.post(
28
            f"{self.base_url}/gateway/rules",
29
            headers=self.headers,
30
            json=policy
31
        )
32
        return response.json()
33

34
    def block_categories(self):
35
        """Block malicious and inappropriate categories"""
36
        categories = [
37
            "security_threats",
38
            "malware",
39
            "phishing",
40
            "cryptomining",
41
            "botnet",
42
            "spam",
43
            "adult_content",
44
            "gambling"
45
        ]
46

47
        for category in categories:
48
            self.create_dns_policy(
49
                name=f"Block {category.replace('_', ' ').title()}",
50
                traffic=f"any(dns.content_categories[*] in {{{category}}})",
51
                rule_settings={
52
                    "block_page_enabled": True,
53
                    "block_reason": f"This site is blocked due to {category} policy"
54
                }
55
            )
56

57
    def create_allowlist(self, domains):
58
        """Create domain allowlist"""
59
        domain_list = " ".join([f'"{d}"' for d in domains])
60

61
        return self.create_dns_policy(
62
            name="Critical Services Allowlist",
63
            traffic=f"any(dns.fqdn in {{{domain_list}}})",
64
            rule_settings={
65
                "action": "allow",
66
                "precedence": 0  # Highest priority
67
            }
68
        )
69

70
    def create_custom_blocklist(self, domains):
71
        """Block specific domains"""
72
        domain_list = " ".join([f'"{d}"' for d in domains])
73

74
        return self.create_dns_policy(
75
            name="Custom Blocklist",
76
            traffic=f"any(dns.fqdn in {{{domain_list}}})",
77
            rule_settings={
78
                "action": "block",
79
                "block_page_enabled": True
80
            }
81
        )
82

83
# Usage
84
gateway = CloudflareGateway(
85
    account_id="your_account_id",
86
    api_token="your_api_token"
87
)
88

89
# Block malicious categories
90
gateway.block_categories()
91

92
# Allowlist critical services
93
gateway.create_allowlist([
94
    "update.microsoft.com",
95
    "update.adobe.com",
96
    "api.company.internal"
97
])
98

99
# Block specific domains
100
gateway.create_custom_blocklist([
101
    "malicious-site.com",
102
    "phishing-example.net"
103
])

1
# Gateway HTTP policies configuration
2
policies:
3
  - name: "Block File Uploads"
4
    enabled: true
5
    action: block
6
    filters:
7
      - http.request.method == "POST"
8
      - http.request.body.size > 10485760  # 10MB
9

10
  - name: "Inspect SSL Traffic"
11
    enabled: true
12
    action: isolate
13
    filters:
14
      - http.host in $suspicious_domains
15
      - ssl.cert.issuer !in $trusted_issuers
16

17
  - name: "Block Unauthorized Downloads"
18
    enabled: true
19
    action: block
20
    filters:
21
      - http.response.headers["content-type"] in ["application/x-executable", "application/x-msdownload"]
22
      - http.host !in $allowed_download_sites
23

24
  - name: "Data Loss Prevention"
25
    enabled: true
26
    action: block
27
    filters:
28
      - http.request.body.contains("SSN:")
29
      - http.request.body.regex("[0-9]{3}-[0-9]{2}-[0-9]{4}")

1
#!/bin/bash
2
# macOS WARP deployment script
3

4
ORGANIZATION_KEY="your-org-key"
5
GATEWAY_UNIQUE_ID="your-gateway-id"
6

7
# Download and install WARP
8
curl -o ~/Downloads/Cloudflare_WARP.pkg https://www.cloudflarewarp.com/Cloudflare_WARP.pkg
9
sudo installer -pkg ~/Downloads/Cloudflare_WARP.pkg -target /
10

11
# Configure WARP
12
cat > /Library/Managed\ Preferences/com.cloudflare.warp.plist << EOF
13
<?xml version="1.0" encoding="UTF-8"?>
14
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
15
<plist version="1.0">
16
<dict>
17
    <key>organization</key>
18
    <string>${ORGANIZATION_KEY}</string>
19
    <key>gateway_unique_id</key>
20
    <string>${GATEWAY_UNIQUE_ID}</string>
21
    <key>auto_connect</key>
22
    <integer>1</integer>
23
    <key>service_mode</key>
24
    <string>warp</string>
25
    <key>support_url</key>
26
    <string>https://help.example.com</string>
27
</dict>
28
</plist>
29
EOF
30

31
# Start WARP service
32
warp-cli register
33
warp-cli connect
34
warp-cli enable-always-on

1
#!/bin/bash
2
# Linux WARP deployment script
3

4
# Add Cloudflare GPG key
5
curl -fsSL https://pkg.cloudflarewarp.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg
6

7
# Add repository
8
echo "deb [arch=amd64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflarewarp.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list
9

10
# Install WARP
11
sudo apt update
12
sudo apt install cloudflare-warp -y
13

14
# Configure WARP
15
sudo warp-cli register --organization "$ORGANIZATION_KEY"
16
sudo warp-cli set-gateway-id "$GATEWAY_UNIQUE_ID"
17
sudo warp-cli set-mode warp
18
sudo warp-cli connect
19
sudo warp-cli enable-always-on
20

21
# Create systemd service
22
cat > /etc/systemd/system/warp-autoconnect.service << EOF
23
[Unit]
24
Description=Cloudflare WARP Auto-Connect
25
After=network.target
26

27
[Service]
28
Type=oneshot
29
ExecStart=/usr/bin/warp-cli connect
30
RemainAfterExit=yes
31

32
[Install]
33
WantedBy=multi-user.target
34
EOF
35

36
sudo systemctl enable warp-autoconnect.service

1
// Device posture integration
2
const devicePostureRules = [
3
  {
4
    name: "Require OS Updates",
5
    type: "os_version",
6
    operating_system: "windows",
7
    version: "10.0.19043",
8
    operator: ">="
9
  },
10
  {
11
    name: "Require Antivirus",
12
    type: "file",
13
    path: "C:\\Program Files\\Windows Defender\\MsMpEng.exe",
14
    exists: true
15
  },
16
  {
17
    name: "Require Disk Encryption",
18
    type: "disk_encryption",
19
    require_all_drives: true
20
  },
21
  {
22
    name: "Check Corporate Certificate",
23
    type: "client_certificate",
24
    certificate_id: "corp-cert-id",
25
    common_name: "*.corp.example.com"
26
  },
27
  {
28
    name: "Firewall Enabled",
29
    type: "firewall",
30
    enabled: true
31
  },
32
  {
33
    name: "Screen Lock Required",
34
    type: "screen_lock",
35
    enabled: true,
36
    lock_deadline: 300  // 5 minutes
37
  }
38
];
39

40
// Apply posture checks to access policy
41
async function enforceDevicePosture(appId, postureChecks) {
42
  const policy = {
43
    name: "Secure Device Access",
44
    decision: "allow",
45
    include: [
46
      {
47
        everyone: true
48
      }
49
    ],
50
    require: postureChecks.map(check => ({
51
      device_posture: {
52
        integration_uid: check.id
53
      }
54
    }))
55
  };
56

57
  // API call to create policy
58
  return createAccessPolicy(appId, policy);
59
}

1
# Integrate CrowdStrike ZTA score
2
import requests
3
import hashlib
4

5
class CrowdStrikePosture:
6
    def __init__(self, client_id, client_secret, cf_account_id, cf_api_token):
7
        self.cs_client_id = client_id
8
        self.cs_client_secret = client_secret
9
        self.cf_account_id = cf_account_id
10
        self.cf_api_token = cf_api_token
11
        self.cs_token = None
12

13
    def get_crowdstrike_token(self):
14
        """Get CrowdStrike API token"""
15
        response = requests.post(
16
            "https://api.crowdstrike.com/oauth2/token",
17
            data={
18
                "client_id": self.cs_client_id,
19
                "client_secret": self.cs_client_secret
20
            }
21
        )
22
        self.cs_token = response.json()["access_token"]
23

24
    def get_device_score(self, device_id):
25
        """Get ZTA score for device"""
26
        headers = {"Authorization": f"Bearer {self.cs_token}"}
27
        response = requests.get(
28
            f"https://api.crowdstrike.com/devices/entities/devices/v1?ids={device_id}",
29
            headers=headers
30
        )
31
        return response.json()["resources"][0]["zta_score"]
32

33
    def create_posture_rule(self, min_score=75):
34
        """Create Cloudflare posture rule for CrowdStrike score"""
35
        rule = {
36
            "name": "CrowdStrike ZTA Score",
37
            "type": "external_evaluation",
38
            "interval": "5m",
39
            "provider": "crowdstrike",
40
            "config": {
41
                "min_score": min_score,
42
                "api_url": "https://api.crowdstrike.com",
43
                "client_id": self.cs_client_id
44
            }
45
        }
46

47
        headers = {
48
            "Authorization": f"Bearer {self.cf_api_token}",
49
            "Content-Type": "application/json"
50
        }
51

52
        response = requests.post(
53
            f"https://api.cloudflare.com/client/v4/accounts/{self.cf_account_id}/devices/posture",
54
            json=rule,
55
            headers=headers
56
        )
57

58
        return response.json()

1
// CASB configuration for Office 365 and Google Workspace
2
const casbPolicies = {
3
  office365: {
4
    name: "Office 365 Security",
5
    integration_type: "api",
6
    tenant_id: process.env.AZURE_TENANT_ID,
7
    client_id: process.env.AZURE_CLIENT_ID,
8
    client_secret: process.env.AZURE_CLIENT_SECRET,
9
    policies: [
10
      {
11
        name: "Block External Sharing",
12
        action: "block",
13
        conditions: {
14
          sharing_domain: { not_in: ["example.com"] }
15
        }
16
      },
17
      {
18
        name: "Require MFA for Admin",
19
        action: "require_mfa",
20
        conditions: {
21
          user_role: "admin",
22
          location: { not_in: ["office_network"] }
23
        }
24
      },
25
      {
26
        name: "Encrypt Sensitive Files",
27
        action: "encrypt",
28
        conditions: {
29
          file_classification: ["confidential", "restricted"]
30
        }
31
      }
32
    ]
33
  },
34

35
  google_workspace: {
36
    name: "Google Workspace Security",
37
    integration_type: "api",
38
    service_account: process.env.GOOGLE_SERVICE_ACCOUNT,
39
    policies: [
40
      {
41
        name: "Monitor Drive Activity",
42
        action: "log",
43
        conditions: {
44
          activity_type: ["download", "share", "delete"],
45
          file_size: { greater_than: "100MB" }
46
        }
47
      },
48
      {
49
        name: "Block Public Links",
50
        action: "block",
51
        conditions: {
52
          visibility: "public",
53
          file_type: ["spreadsheet", "document"]
54
        }
55
      }
56
    ]
57
  },
58

59
  slack: {
60
    name: "Slack DLP",
61
    integration_type: "inline",
62
    policies: [
63
      {
64
        name: "Detect PII",
65
        action: "redact",
66
        patterns: [
67
          "\\b[0-9]{3}-[0-9]{2}-[0-9]{4}\\b",  // SSN
68
          "\\b[0-9]{16}\\b",  // Credit card
69
          "\\b[A-Z]{2}[0-9]{6}\\b"  // Passport
70
        ]
71
      }
72
    ]
73
  }
74
};
75

76
// Apply CASB policies
77
async function configureCASB(policies) {
78
  const headers = {
79
    'Authorization': `Bearer ${process.env.CF_API_TOKEN}`,
80
    'Content-Type': 'application/json'
81
  };
82

83
  for (const [app, config] of Object.entries(policies)) {
84
    const response = await fetch(
85
      `https://api.cloudflare.com/client/v4/accounts/${CF_ACCOUNT_ID}/gateway/app_types`,
86
      {
87
        method: 'POST',
88
        headers,
89
        body: JSON.stringify(config)
90
      }
91
    );
92

93
    console.log(`CASB configured for ${app}:`, await response.json());
94
  }
95
}

1
# DLP profile configuration
2
import re
3
import requests
4

5
class CloudflareDLP:
6
    def __init__(self, account_id, api_token):
7
        self.account_id = account_id
8
        self.api_token = api_token
9
        self.base_url = f"https://api.cloudflare.com/client/v4/accounts/{account_id}"
10

11
    def create_dlp_profile(self, name, entries):
12
        """Create custom DLP profile"""
13
        profile = {
14
            "name": name,
15
            "description": f"DLP profile for {name}",
16
            "type": "custom",
17
            "entries": entries
18
        }
19

20
        headers = {
21
            "Authorization": f"Bearer {self.api_token}",
22
            "Content-Type": "application/json"
23
        }
24

25
        response = requests.post(
26
            f"{self.base_url}/dlp/profiles",
27
            json=profile,
28
            headers=headers
29
        )
30

31
        return response.json()
32

33
    def create_pii_profile(self):
34
        """Create PII detection profile"""
35
        entries = [
36
            {
37
                "name": "US Social Security Number",
38
                "pattern": r"\b\d{3}-\d{2}-\d{4}\b",
39
                "enabled": True
40
            },
41
            {
42
                "name": "Credit Card Number",
43
                "pattern": r"\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b",
44
                "enabled": True
45
            },
46
            {
47
                "name": "Email Address",
48
                "pattern": r"\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b",
49
                "enabled": True
50
            },
51
            {
52
                "name": "Phone Number",
53
                "pattern": r"\b\d{3}[-.]?\d{3}[-.]?\d{4}\b",
54
                "enabled": True
55
            },
56
            {
57
                "name": "Passport Number",
58
                "pattern": r"\b[A-Z]{1,2}\d{6,9}\b",
59
                "enabled": True
60
            },
61
            {
62
                "name": "Bank Account",
63
                "pattern": r"\b\d{8,17}\b",
64
                "enabled": True
65
            }
66
        ]
67

68
        return self.create_dlp_profile("PII Detection", entries)
69

70
    def create_source_code_profile(self):
71
        """Create source code detection profile"""
72
        entries = [
73
            {
74
                "name": "API Key",
75
                "pattern": r"(?i)(api[_\s]?key|apikey)[\s]*[:=][\s]*['\"]?[\w\-]+['\"]?",
76
                "enabled": True
77
            },
78
            {
79
                "name": "AWS Access Key",
80
                "pattern": r"AKIA[0-9A-Z]{16}",
81
                "enabled": True
82
            },
83
            {
84
                "name": "Private Key",
85
                "pattern": r"-----BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY-----",
86
                "enabled": True
87
            },
88
            {
89
                "name": "Database Connection String",
90
                "pattern": r"(?i)(mongodb|mysql|postgresql|redis):\/\/[^\\s]+",
91
                "enabled": True
92
            }
93
        ]
94

95
        return self.create_dlp_profile("Source Code Protection", entries)
96

97
    def apply_dlp_policy(self, profile_id, action="block"):
98
        """Apply DLP profile to Gateway policy"""
99
        policy = {
100
            "name": f"DLP Policy - {profile_id}",
101
            "enabled": True,
102
            "action": action,
103
            "filters": [f"dlp.profile.{profile_id}"],
104
            "precedence": 1,
105
            "rule_settings": {
106
                "block_page_enabled": True,
107
                "block_reason": "This content violates data protection policies"
108
            }
109
        }
110

111
        headers = {
112
            "Authorization": f"Bearer {self.api_token}",
113
            "Content-Type": "application/json"
114
        }
115

116
        response = requests.post(
117
            f"{self.base_url}/gateway/rules",
118
            json=policy,
119
            headers=headers
120
        )
121

122
        return response.json()
123

124
# Usage
125
dlp = CloudflareDLP(account_id="your_account_id", api_token="your_api_token")
126

127
# Create and apply PII protection
128
pii_profile = dlp.create_pii_profile()
129
dlp.apply_dlp_policy(pii_profile["result"]["id"], action="block")
130

131
# Create and apply source code protection
132
code_profile = dlp.create_source_code_profile()
133
dlp.apply_dlp_policy(code_profile["result"]["id"], action="log")

1
# WARP client split tunnel configuration
2
split_tunnel:
3
  mode: "exclude"  # or "include"
4

5
  # Traffic to exclude from tunnel (goes direct)
6
  exclude:
7
    ipv4:
8
      - "192.168.0.0/16"
9
      - "172.16.0.0/12"
10
      - "10.0.0.0/8"
11
    ipv6:
12
      - "fc00::/7"
13
    domains:
14
      - "*.local"
15
      - "*.internal.company.com"
16
    applications:
17
      - "zoom.exe"
18
      - "teams.exe"
19
      - "webex.exe"
20

21
  # Traffic to include in tunnel (when mode is "include")
22
  include:
23
    ipv4:
24
      - "0.0.0.0/0"
25
    domains:
26
      - "*.company.com"
27
      - "*.saas-app.com"

1
// Calculate and track user risk scores
2
class UserRiskScoring {
3
  constructor(cfApi) {
4
    this.cfApi = cfApi;
5
    this.riskFactors = {
6
      failed_logins: { weight: 10, threshold: 3 },
7
      unusual_location: { weight: 20, threshold: 1 },
8
      impossible_travel: { weight: 50, threshold: 1 },
9
      new_device: { weight: 15, threshold: 2 },
10
      malware_detected: { weight: 100, threshold: 1 },
11
      dlp_violations: { weight: 30, threshold: 2 },
12
      unusual_hours: { weight: 5, threshold: 5 },
13
      high_data_transfer: { weight: 25, threshold: 1 }
14
    };
15
  }
16

17
  async calculateUserRisk(userId, timeWindow = 86400000) { // 24 hours
18
    const events = await this.getUserEvents(userId, timeWindow);
19
    let riskScore = 0;
20
    const riskBreakdown = {};
21

22
    for (const [factor, config] of Object.entries(this.riskFactors)) {
23
      const count = events.filter(e => e.type === factor).length;
24
      if (count >= config.threshold) {
25
        const score = config.weight * (count / config.threshold);
26
        riskScore += score;
27
        riskBreakdown[factor] = {
28
          count,
29
          score,
30
          severity: this.getSeverity(score)
31
        };
32
      }
33
    }
34

35
    return {
36
      userId,
37
      riskScore,
38
      riskLevel: this.getRiskLevel(riskScore),
39
      breakdown: riskBreakdown,
40
      timestamp: new Date().toISOString(),
41
      recommendations: this.getRecommendations(riskScore, riskBreakdown)
42
    };
43
  }
44

45
  getRiskLevel(score) {
46
    if (score >= 100) return 'CRITICAL';
47
    if (score >= 75) return 'HIGH';
48
    if (score >= 50) return 'MEDIUM';
49
    if (score >= 25) return 'LOW';
50
    return 'MINIMAL';
51
  }
52

53
  getSeverity(score) {
54
    if (score >= 50) return 'critical';
55
    if (score >= 30) return 'high';
56
    if (score >= 15) return 'medium';
57
    return 'low';
58
  }
59

60
  getRecommendations(score, breakdown) {
61
    const recommendations = [];
62

63
    if (score >= 100) {
64
      recommendations.push('Immediate account suspension recommended');
65
      recommendations.push('Initiate security incident response');
66
    }
67

68
    if (breakdown.malware_detected) {
69
      recommendations.push('Isolate device and run full security scan');
70
    }
71

72
    if (breakdown.impossible_travel) {
73
      recommendations.push('Verify user identity through secondary channel');
74
    }
75

76
    if (breakdown.dlp_violations) {
77
      recommendations.push('Review data access logs and revoke unnecessary permissions');
78
    }
79

80
    return recommendations;
81
  }
82

83
  async getUserEvents(userId, timeWindow) {
84
    // Fetch events from Cloudflare logs
85
    const endTime = Date.now();
86
    const startTime = endTime - timeWindow;
87

88
    const query = {
89
      userId,
90
      timestamp: { $gte: startTime, $lte: endTime }
91
    };
92

93
    return await this.cfApi.getLogs(query);
94
  }
95

96
  async enforceRiskBasedAccess(userId) {
97
    const risk = await this.calculateUserRisk(userId);
98

99
    if (risk.riskLevel === 'CRITICAL') {
100
      await this.cfApi.blockUser(userId);
101
    } else if (risk.riskLevel === 'HIGH') {
102
      await this.cfApi.requireMFA(userId);
103
      await this.cfApi.limitAccess(userId, ['critical_apps']);
104
    } else if (risk.riskLevel === 'MEDIUM') {
105
      await this.cfApi.requireReauth(userId, 3600); // Re-auth every hour
106
    }
107

108
    return risk;
109
  }
110
}