In this blog post, we wanted to highlight some ways that Cloudflare and IBM Cloud work together to help drive product innovation and deliver services that address the needs of our mutual customers. On our blog, we often discuss exciting new product developments and how we are solving real-world problems in our effort to make the internet better and many of our customers and partners play an important role.

IBM Cloud and Cloudflare have been working together since 2018 to integrate Cloudflare application security and performance products natively into IBM Cloud. IBM Cloud Internet Services (CIS) has customers across a wide range of industry verticals and geographic regions but they also have several specialist groups building unique service offerings.

The IBM Cloud team specializes in serving clients in highly regulated industries, aiming to ensure their resiliency, performance, security and compliance needs are met. One group that we’ve been working with recently is IBM Cloud for Financial Services. This group extends the capabilities of IBM Cloud to help serve the complex security and compliance needs of banks, financial institutions and fintech companies.

As malicious bot attacks get more sophisticated and manual mitigations become more onerous, a dynamic and adaptive solution is required for enterprises running Internet facing workloads. With Cloudflare Bot Management on IBM Cloud Internet Services, we aim to help IBM clients protect their Internet properties from targeted application abuse such as account takeover attacks, inventory hoarding, carding abuse and more. Bot Management will be available in the second quarter of 2023.

Threat actors specifically target financial services entities with Account Takeover Attacks, and this is where Cloudflare can help. As much as 71% of login requests we see come from bots (Source: Cloudflare Data) Cloudflare’s Bot Management is powered by a global machine learning model that analyses an average of 45 million HTTP requests a second to track botnets across our network. Cloudflare’s Bot Management solution has the potential to benefit all IBM CIS customers.

IBM Cloud has been a leader when it comes to providing solutions for the financial services industry and has developed several key management solutions that are designed so clients only need to store their private keys in custom built devices.

The IBM CIS team wants to incorporate the right mix of security and performance, which necessitates the use of cloud-based DDoS, WAF, and Bot Management. Specifically, they wanted to incorporate the powerful security tools that were offered through IBM’s Enterprise-level Cloud Internet Services offerings. When using a cloud solution, it is necessary to proxy traffic which can create a potential challenge when it comes to managing private keys. While Cloudflare adopts strict controls to protect these keys, organizations in highly regulated industries may have security policies and compliance requirements that prevent them from sharing these private keys.

Enter Cloudflare’s Keyless SSL solution.

Cloudflare built Keyless SSL to allow customers to have total control over exactly where private keys are stored. With Keyless SSL and IBM’s key storage solutions, we aim to help enterprises benefit from the robust application protections available through Cloudflare’s WAF, including Cloudflare Bot Management, while still retaining control of their private keys.

“We aim to ensure our clients meet their resiliency, performance, security and compliance needs. The introduction of Keyless SSL and Bot Management security capabilities can further our collaborative accomplishments with Cloudflare and help enterprises, including those in regulated industries, to leverage cloud-native security and adaptive threat mitigation tools.”— Zane Adam, Vice President, IBM Cloud.

“Through our collaboration with IBM Cloud Internet Services, we get to draw on the knowledge and experience of IBM teams, such as the IBM Cloud for Financial Services team, and combine it with our incredible ability to innovate, resulting in exciting new product and service offerings.”— David McClure, Global Alliance Manager, Strategic Partnerships

If you want to learn more about how IBM leverages Cloudflare to protect their customers, visit: https://www.ibm.com/cloud/cloudflare

IBM experts are here to help you if you have any additional questions.

As we prepare for the IBM Think customer conference in San Francisco this week, the Cloudflare team is excited about the opportunities ahead. We closed 2018 with momentum, bringing several of the world’s leading brands onto the Cloud Internet Services (CIS) platform in 2018. Customers have used CIS for several purposes, including:

• The CIS Global Load Balancer provides high availability across IBM Cloud regions for customers in Europe, North America, and Latin America

• CIS caching capabilities have ensured availability and performance for world spectator events with high traffic spikes

• The CIS authoritative DNS delivers greater availability and performance for Internet-facing workloads supporting thousands of developers

At Think, please visit Cloudflare at our booth (#602). In addition, you may want to visit these interesting discussions:

Hear from Satinder Sethi, GM of IBM Cloud Infrastructure, and Cloudflare’s CEO Matthew Prince, discuss the trade-offs of current and emerging technologies for infrastructure design, particularly for organizations operating in a hybrid or multi-cloud environment.

An overview of the benefits of IBM Cloud Internet Services, seamlessly integrated with IBM Cloud platform security controls.

Find out how, after years of iteration, the team at The Weather Company has found a unique way of using edge computing to assemble heterogeneous website resources into a single, highly reliable and performant site.

We’re also thrilled to support IBM Cloud’s announcement of the addition of new Cloudflare capabilities to the CIS suite of security and performance features. These capabilities make the CIS offering even more useful to IBM’s customers who desire to make their Internet-facing applications and APIs secure, resilient, and fast.

Here is a short list of use cases for the new features that IBM is releasing in the CIS Enterprise Plan:

1.    Enable robust analytics and forensics

We are introducing CIS Enterprise Log Share which enables CIOs and security leaders to ingest log data into their data repository, business intelligence tool, and/or Security Incident Event Management system of choice. This will enable correlation analysis to develop insights about attacks.

1.    Protect and accelerate non-HTTP traffic

Many of our joint customers run applications that utilize non-HTTP traffic. To serve these customers, Cloud Internet Services Range allows the mitigation of Layer 3 and 4 volumetric DDoS attacks to keep all TCP and UDP-based services online and secure across ports that run TCP and UDP protocols.  It will also protect these ports from data snooping and theft by encrypting traffic with SSL/TLS.

1.    Run custom logic on the edge

Serverless computing is increasingly attractive to application developers for a variety of reasons:  lower latency, more granular control, greater security, and savings on store and compute resources.

With CIS Edge Functions, now available in beta, Customers can realize serverless computing benefits by running complex logic and code at the network edge. IBM Cloud Internet Services Edge Functions allows JavaScript to be deployed on the Cloudflare network, enabling customers to deploy their code to over 165 data centers around the world in less than 30 seconds. Use cases include: intercept and modify any request made to an application, make outbound requests to any URL on the Internet, and maintain fine-grained control over how users manage traffic that interacts with Internet-facing workloads.

Customers who are running mission-critical Enterprise applications that cannot afford downtime or suboptimal performance should also be aware of these existing CIS Enterprise features:

• For applications with a global user base, leverage CIS Smart Routing to effectively route requests effectively globally

• For high-value applications that tend to receive a variety of Layer 7 attack types, which require only the right visitors to gain access, use CIS Custom WAF rules

• For applications that need constant monitoring and failover, five-second health checks are available

All of these capabilities are available through the CIS Enterprise Plan. To get started with any of these capabilities, please review the plans here.

The IBM and Cloudflare partnership advances both organizations’ missions, and it helps IBM customers accelerate and protect anything connected to the internet.  To find out more about the partnership, please see here.

CIS delivers security and performance to IBM Cloud® customers’ internet applications. It brings together Cloudflare’s 150+ points of presence with IBM Cloud’s 60 data centers, stopping attacks before they can even reach the IBM Cloud. CIS Enterprise is integrated into IBM Cloud, allowing IBM Cloud customers to set up and manage Cloudflare’s DDoS mitigation, web application firewall, smart routing and highly customizable load balancer, all from within the IBM Cloud user interface.  

Our Network Map (as of 10/18/18). Click here for the latest version

We thought it timely to give a refresher on how Cloudflare’s network supports IBM Cloud customers. The network is designed to meet requirements of the most demanding enterprise customers. It is based on an architecture that differentiates it from legacy CDN, DNS and DDoS-mitigation services to ensure that internet applications stay online, even in the face of extremely high volume attacks or legitimate traffic spikes.

Cloudflare’s network of data centers, distributed across 74 countries (including 22 in China), has a network capacity that is 12x bigger than the largest DDoS attack ever recorded and sees 10% of all HTTP requests each month. Indeed, thanks to this capacity, we were able to mitigate one of the largest attacks recorded of close to 1TBps earlier this year without any impact to our network, customers or the 2.8 billion users per month who interact with domains using Cloudflare. With more than 20 Tbps of capacity, it can handle any modern distributed attack, including those targeting DNS infrastructure. The benefits of this network accrue to the 11 million domains on Cloudflare’s network by means of a simple change to DNS settings.

Every one of Cloudflare’s data centers offers the same complete stack of performance and security services. This allows each server to handle the entirety of a user’s interaction, from initial DNS query to security checks to final content delivery. This architecture makes it simple to scale out the Cloudflare network and to add more and more data centers in close proximity to our customers. This means that traffic generated from DDoS attacks can be mitigated as close to the source as possible, spreading attacks across the various Cloudflare data centers, instead of concentrating the mitigation efforts to scrubbing centers, which often significantly increase latency for end users. For Enterprise customers, it means we can protect and accelerate the most complex and highly trafficked applications.

IBM Cloud customers can access the Cloudflare network via the IBM Cloud dashboard. Thanks to this integration, IBM Cloud customers can manage their hosting and web security through one vendor.  While here at Cloudflare we deal with some very complex problems, our goal has always been to make individual account management straightforward for all of our users. The CIS integration is consistent with that approach, surfacing key features in a familiar interface without the need to manage multiple settings.

Lastly, IBM Cloud recently joined the Bandwidth Alliance to waive data transfer fees between IBM and Cloudflare servers for IBM Cloud Internet Services enterprise plan customers. This is an important step forward to reduce customers’ hosting costs.

CIS Enterprise comes in two plan types, you can either sign up online or speak to your IBM Cloud account manager to learn more.

A Tale of Two New Relationships

Late last spring, we were seeking to expand our connections inside of IBM. IBM had first become a direct Cloudflare customer in 2016, when its X-force Exchange business selected Cloudflare, instead of traditional scrubbing center solutions, for DDoS protection, WAF, and Load Balancing. We had friendly relationships with several people inside of IBM’s Softlayer business. We learned that the IBM “Networking Tribe” was evaluating various solutions to fill product gaps that their cloud customers were experiencing for DDoS, DNS, WAF, and load balancing.

In trying to engage with the people leading the effort, I made a casual phone call late on a Friday afternoon to one of the IBMers based in Raleigh, NC. When he understood that I was from Cloudflare, he replied, “Oh, I know Cloudflare. You do DDoS protection, right?” I replied, “Well, yes, we do offer DDoS protection, but we also offer a number of other security and performance services.” He indicated that he would be in the Bay Area two weeks later, and that he would bring his team to our office if we could make the time.

Also late last spring, my wife delivered our baby boy. I was scheduled to be on paternity leave during the IBMers’ trip to the Bay Area. Although I was intently focused on practicing modern burping techniques, this seemed like an exciting enough opportunity that I was able to convince my family’s leadership team (aka my wife) that I should sneak into the office for a couple of hours while my son slept.

Before their visit, the IBM team told us that they had evaluated a number of point solutions to fill the different product gaps, and that they had specific requirements for each type of solution. During our discussion, it became apparent that the Cloudflare network and architecture, which allows multiple security and performance services to be delivered easily and cost-effectively to end users around the world, could be a more effective approach than cobbling together point solutions. They wouldn’t have to integrate with multiple vendors, and their customers could achieve best-of-breed results while paying low, transparent prices.

Then the real work began, when the IBM team began to dig into our API documentation, run tests, and learn a lot more about our company. During the next five months, across multiple meetings in several cities, IBM became convinced that they should select Cloudflare to fill all of its product gaps. Cloudflare was ultimately selected for our trusted presence around the globe, scalable architecture, rich set of well-documented APIs, competitive and predictable pricing model, and commitment to empowering enterprise customers.

IBM’s new “Cloud Internet Services” offering, powered by Cloudflare, will enable IBM Cloud customers to easily purchase and configure mission-critical web performance and security solutions. These solutions solve critical security problems faced by enterprises, including DDoS mitigation, bot protection, and data theft protection as well as performance challenges, including ensuring application availability and accelerating internet applications and mobile experiences.

With Cloud Internet Services, IBM Cloud customers can get Cloudflare’s core DDoS, WAF, DNS, CDN, and related solutions through the IBM Cloud Dashboard with a few clicks. Certain Cloudflare services, typically available only in Cloudflare Enterprise Plans, can be purchased via the IBM sales team.

Concurrent with this announcement, IBM becomes an authorized reseller of Cloudflare’s entire suite of services. Cloudflare’s solutions can be deployed in any IBM customer environment, including on-premise, hybrid cloud, or public cloud.

Founded in 1911 as the Computing-Tabulating-Recording Company (CTR), IBM was renamed "International Business Machines" in 1924. Over the past century, IBM has set the standard for innovation among corporations in America. One of the world's largest employers, with more than 380,000 employees and operations in 170 countries, IBM employees have been awarded five Nobel Prizes, six Turing Awards, ten National Medals of Technology, and five National Medals of Science. IBM holds the record for most patents generated by a business (as of 2018) for 25 consecutive years. During the modern era, IBM became famous for the IBM mainframe, exemplified by the System/360, the dominant computing platform during the 1960s and 1970s. More recently, IBM’s AI platform “Watson” powers new consumer and enterprise services in the health care, financial services, retail, and education markets.

Cloudflare is delighted to be working with IBM to expand our enterprise footprint. IBM has broad, deep experience and decades-long relationships with the world’s leading manufacturing, financial services, public sector, retail, and technology brands.

Enterprise customers will now be able to leverage and expand investments in IBM’s infrastructure offerings to realize faster, more secure web properties. As an example, enterprise customers who utilize IBM’s identity management services can invoke Cloudflare services through SSO, maintaining roles and access rights they are accustomed to.

While still in its infancy, our partnership promises to bear fruit in multiple product and solution areas. Our shared vision includes harnessing the power of the Cloudflare data set. Integration with IBM QRadar, a flexible security analytics platform, is planned for release in the coming months. Longer-term, applications for end customers that leverage Watson for Cyber Security, can be developed.

All of this is possible as a result of Cloudflare’s cloud-native, API-first suite of network edge solutions. We couldn’t be more pleased about our opportunity to work together with IBM to deploy mission-critical security and performance edge services to enterprises around the world.

Interested in learning more about the partnership? Get in touch!