Cloudflare jumps into IoT

Cloudflare has long been known for it's website protection services (DDoS protection, rate limiting, load balancing, etc), and CDN capabilities. Really, they're huge in this space, and it would seem they have now taken notice of the sorry state of IoT security in general and have turned their considerable attention to doing something about it.

A new service has been launched aimed squarely at the manufacturers of connected devices. The service promises to remove the burden of securing and patching large numbers of devices out in the wild through a number of features. A big selling point on the security front is acting as an intermediary between the devices and the cloud service they rely upon. By providing an encrypted channel between the two, with Cloudflare handling authentication, the theory is that malicious attacks can be all but blocked. An industrial firewall is also provided in this setup which allows Cloudflare to block attacks at the network level.

Additional features are aimed at allowing vendors to address vulnerabilities permanently but buying time to analyze and test updates thoroughly, and then offering a cached patching service on Cloudflare's infrastructure to reduce bandwidth consumption at the vendor end. This could certainly be a significant factor in some vendors reluctance to provide ongoing update support where they have large device counts in service.

The service is also claiming to improve device battery life through taking advantage of compression and transmission optimizations. This would seem more of a cherry, and would surely depend on the communications requirements and architecture, although I support vendors could actively look to leverage that aspect if they're on board with the service up front.

Given Cloudflare's chops on the website market, this can only be a good thing for the IoT space, and hopefully vendors less willing or able to build in security at design time will take advantage.

Find out more at the Cloudflare Orbit site.