Name: Securing Connectivity: A Modern Approach to Zero Trust
Uploaded: 2025-12-09T04:16:04.698Z
Duration: 54 min 56 s
Description: Securing Connectivity: A Modern Approach to Zero Trust

Transcript for "Securing Connectivity: A Modern Approach to Zero Trust": Hi. Welcome. We're gonna give a a a minute or two just to let more people join, and then we'll get started. Alright. Well, thank you all for joining us. So my name is Aaron Wilkie. I'm the product specialist at Cloudflare. So I focus predominantly on Cloudflare one, which is the Cloudflare zero trust portfolio. Today, we got a a very interesting session. We're gonna be joined by Sam Fisher, and Sam is the National ICT Solutions Manager at EREA Flexible Schools, and we're gonna be doing a bit of a fireside chat discussion with Sam around his business requirements that took him down the journey of zero trust and, and, you know, what brought him to Cloudflare, what he liked, and so on and so forth. So we're hoping you're gonna enjoy today's session. We'll get started with the slides, but before I do, I'll let Gary introduce himself and then we'll get started. Thank you, Aaron. Good morning. Good afternoon. My name is Girira Jairaman. I'm a specialist solutions engineer for CloudFlare one products. Today, myself and Aaron will be your host. Oh, Thank you very much, Gary. to you, So. thanks for joining. I know this time of the year is, busy for everyone and hopefully you get a lot out of today's session. So a bit of housekeeping, there is a Q and A section, you'll see up in the top right of your screen. If you have any questions, by all means, please place them in the Q and A area and we'll endeavor to ask them as answer them sorry as we go through today's session. So let's get stuck in. So a bit of an agenda. So first off, I'm gonna start by a bit of a high level overview around Cloudflare Zero Trust and how not just around Cloudflare Zero Trust or Cloudflare One, but also how we approach Zero Trust or SASE in the market. We've got a fairly unique architecture. It's an advantage of Cloudflare having a global platform and this architecture allows us to deliver some pretty unique services and functions as part of our zero trust functionality. So I'll cover that. Then Gary is gonna come in and and talk around some of the architecture principles that we're finding are resonating with various customers in the market today, how we actually go to market with those, how we actually deliver them in in in, in real scenarios, and especially how we were gonna, align those to how Sam and the EREA flexible school schools, deployed Cloudflare and the value they get out of it. When we look at Cloudflare and a lot of conversation comes around all of our services, but what is Cloudflare? So we're a global platform. Okay? So we run on our own TIN, in over 335 cities, which over 650 pops globally. The reason we why we have such a huge, network is because we wanna get as close to the end user as possible. So when we think about cloud services, a couple of things become apparent. The first is, yes, you're moving to more of a SaaSy architecture and where you wanna move that functionality from your traditional data center into the cloud. But b, we wanna make sure that it says the user experience is is tuned and in such a manner that we don't degrade user experience, we actually enhance user experience. So some of the advantages we have with this global platform is we've got an open pairing policy. So that means that anyone can pair with Cloudflare. The advantage to that being is, accessing services regardless if they're existing on the public Internet and the private data center can utilize Cloudflare's network to actually enhance the user experience. So when we look at all of those six forty odd points of presence, the key thing to keep in mind is all of the services that Cloudflare offer and you would all be familiar with our services, but all of the services we offer run out of every single one of our data centers. What we don't do is have certain regions that just do certain things like DDoS scrubbing or RBI or browser isolation, things like that. So you can, keep in mind that as you connect to the closest data center and we'll talk around how our architecture allows you to connect to the closest data center, then all of the functionality is available there. All of the processing happens at that edge. The end result being a more performant user experience for you as users, but also a better path to accessing the content that's available, that you wanna access as part of delivery services for your customers. Okay. So the key thing is Cloudflare is a global platform. We run on our own tin, so we're not beholden to any hyper hyper scalers or or or third parties in, delivering the services we have. Now when we look at the SASE platform, so the SASE platform being Cloudflare One is a subset of the services that we run. And really what we want to get to is a a not what we want to get to, but what we offer is a single programmable interface. All of the services you see that run on Cloudflare are all available through Cloudflare Dash. It's a single point to configure, it's a single point to manage, and it's a single point to maintain your Cloudflare services. We have a unique slant on how we deliver our SASE architecture in that regardless of the user, regardless of the device or the location or whatever services that a user needs to access, all of those services are through to every single one of our points of presence. But we have a solution or an architecture to help facilitate access regardless regardless, sorry, if it's a managed device or an unmanaged device, regardless regardless if it's an on prem service or a cloud hosted service. Also contributing to our SASE platform is our network as a service offering, which means that you can utilize Cloudflare's backbone to give access across the Internet to services that you need to access. So the key thing is all of these services exist in a 100% SLA for our platform, and we're able to deliver a 100% SLA because of the unique way we deliver access to our services. So we run an any cast based architecture. So what does that mean? It means that you as a customer, you get an IP address that's advertised out of every single one of our points of presence. So for example, if you're a user sitting in Brisbane, Sydney, Melbourne, and you travel overseas to The US or or where wherever you need to go for work, nothing needs to change. You don't need to do any manual intervention to get access to the services you you you need to access. It's the exact same user experience. So as you move around the globe, you can be sure to be directed to the closest point of presence, and that's the that's truly the advantage of the anycast approach. In the event that, you know, a pop goes offline or a city goes offline or something like that, from an operational perspective, there is no overhead or there's no operational process that you need to follow to return services. All that happens is you get directed to the next closest data center. Okay? So this Anycast architecture is very unique, and it's different to majority of the SASE vendors out there. And it's it's this reason why we're able to extend the 100% SLA across our feet our our functionality. Now we are a Cloud service. Right? So you need to be able to get to us. But one thing we don't do is dictate the architecture of how to get to us. What we have is a number of different methods that enable you to connect to Cloudflare. Now one of the unique things is that we call them on ramps. So an on ramp is just a method of connecting to Cloudflare or Cloudflare connecting to your service. So across all these different on ramps, one thing is unique is it's not a skew. Right? So it's not, it's not something you have to pay for. What we do is we work with you and we work with our customers on what on ramp makes architectural sense for your environment. So we don't ask customers to modify their environment for an architecture that that's new to consume these service. What we would do is we'd work with you to actually work out what is the best approach. Do I have existing CPEs in my branch office? Do I wanna connect the whole site and provide protection for OT devices? I've got roaming users. I can use a WARP client to connect to any other devices I need to connect any other services I want to connect to. We also have what's called network interconnects and this is fairly unique. Right? So network interconnects allow us to pair with other networks. So it means things like if you wanna get access to your, your AWS, IS service, you can actually use a cloud for a cloud network interconnect to provide that. All of these unique on ramps are something that we would work with you as part of that Zero Trust journey. It's not something we would dictate to you and what this allows customers to achieve is it allows them to achieve the flexibility of consuming Cloudflare services without complex integration headaches. And it means that, in in very short time, we can have you running up and on Cloudflare, very simply without a lot of overhead and and professional services. Now Cloudflare does more than just zero trust. So a lot of you that have joined the session today understand Cloudflare for maybe some of the features or some of the services that we offer. So if we look at what Cloudflare offers from a thousand or 20,000 foot view, A lot of people are experienced with our application services. So application services sit in front of your public facing portals, your networks protect against things like layer seven attacks, you know, volumetric DDoS, layer seven DDoS, bot manage, bot attacks, things like that. Now the unique thing is with all of our services, they're not isolated. So the threat intelligence we get from let's say our application services to categorize different websites is actually used across our zero trust services. Today what we're going to focus on is the two orange boxes you see They make up what we call Cloudflare One. Our Zero Trust services and our Network services. Our Zero Trust services, I'm not going to go into them in any great detail just to give you a high level view of what they do. The Zero Trust Network Access typically is used for arranging access to private applications. Traditionally, you know, VPN or or published shared desktops were facilitated to provide this access. So we have taken that and we've wrapped the zero trust the zero trust principles around facilitating a better method to access private applications and services. Then we look at Secure Web Gateway, which is all about protecting outbound access. What is a user actually doing while they're out on the Internet? Can should I be restricting them to certain AI tools? Should I be looking for things, like malware in certain sites? What are those sites characterized as? A high level view, especially, considering there's a lot of depth in a lot of these services, but just to give you a a brief understanding of what they do. CASB is really around providing protection to services you consume as a service. So really around your SaaS services. You know, we have a couple of methods of providing control for users accessing SaaS services. The CASB facilitates it via API, and then we use the we use the secure web gateway to do in path controls. We also have an email security solution as part of the zero trust, portfolio. That's because email is still the most, widely used, method to provide a text into organizations. And no matter how much user training is provided, users still click on links, users still open attachments even from trusted sources. Now the key is for our email security, we are not an email gateway. That is not where we play. You have your Microsofts. You have your your Googles to provide that email gateway functionality, archiving, and things like that. So what's unique is we provide protection for advanced phishing attacks and advanced business email compromise attacks. Okay? And then we look around, we've got browser isolation. So we'll be getting into a bit of detail on what browser isolation does, but really it's facilitating access in an alternate manner to public resources or private resources through a sandbox isolated browser and through that we can do various controls, right? We can we can do data exfiltration controls. We can do things like preventing copy in place, preventing file upload download. So it all comes part and parcel with the last one on the within the box was data loss prevention. Right? As we know, as we as we work day in day out, you know, what becomes really empowering apparent is data is the crown jewels. Right? We don't want any sensitive data being put onto the net. We don't want people using untrusted AI tools to paste things, to rewrite emails with sensitive data in there. So we've got techniques within our Zero Trust services to prevent against data exfiltration. All of these come together. It can be a pick your own journey or now we've released bundles to allow customers to be able to consume some of the common services that are typically bound together. But the unique thing is what you have is a platform that delivers all this functionality and takes the intelligence from every single customer that we have globally. Okay? So all of that threat intelligence gets used across all of our services from all of our customers. So that's a brief overview of the Cloudflare Zero Trust platform. With that, I'm going to pass to Gary. He's going to talk a bit about the architecture. Over to you, Gary. Thank you, Aaron. Before we get into the architecture, we'll have a short poll and see what is the response we get from the audience. Okay. Here we go. So have you implemented Microsoft conditional access or source IP restriction for your SaaS applications? Let's wait for people to respond to the poll. Can I see one poll yes and two poll no? Alright. I see three yes. Alright. We'll we'll definitely cover about how Cloudflare One relates with Microsoft Conditional Access and Source IP. Let's get into the Cloudflare One architecture. If you see this diagram, I'm pretty sure that you're familiar with. On the left hand side is your corporate network or your users or your contractors who is trying to access a SaaS application or a private application hosted in your data center or in your Cloud services. Using CloudFlare as a platform, the common use case customer use our service is to provide secure connectivity between the corporate network to Internet, and a remote user to Internet or SaaS application. The same solution can also be used to provide a secure connectivity between two private networks, between a branch to branch and remote user to a branch or remote user to a private application hosted in your data center. Using Cloudflare, you can replace your existing secure web gateway or traditional VPN services. Beyond that, network as a services enables you to secure connectivity between two private networks or remote offices. The fundamental of Internet is DNS filtering. When Cloudflare started its journey, we started as a authoritative DNS. As Cloudflare One is a service on top of the existing layer, we also use Cloudflare One service to protect DNS filtering. What it means is if you have your users browsing Internet from your corporate network or if a user is working from remote or you have a OTR or IoT environment using Cloudflare one or Zero Trust platform, DNS Filtering is one of the offerings as part of the solution. What it means to you is when a user, who cannot deploy an agent, a typical example is a guest Wi Fi network. If you have a guest Wi Fi network or a OTR IoT network, you cannot deploy the agent. But how do you secure the Internet access from a guest Wi Fi network or a OTR IoT network? Using Cloudflare DNS filtering, which is one of the functionality of the Cloudflare One product, we would be able to forward all the Internet based DNS query to the closest Cloudflare Edge, and we can allow our block based on your organization's security policy. What I personally like about the Cloudflare DNS filtering solution is two advantage. One, you can bring your own IP address. If you have a slash 34 prefix IP, we can onboard it to your Cloudflare one solution and you can configure your own IP address as a DNS resolver to resolve DNS queries. If you do not have a slash 24 IP, CloudFlare has ability to provide a dedicated DNS resolver for your organization. So if you see some legacy DNS filtering solutions, it requires a public IP to create a location and filter the, Wi Fi traffic or, OT traffic. But using Cloudflare Dedicated DNS Resolver without the needing of the source IP restriction, you'll be able to apply DNS filtering policies and block bad website or malicious websites. Of course, before I joined Cloudflare, I'm pretty sure that everybody is familiar with 1.1.one. If you do not use 1.1.one, I would highly encourage you to configure it in your home router. It does not require any additional charges. Our mission is to protect the Internet using 1.1.one. You can protect your home network or any network using Cloudflare public DNS resolver. Let's switch the queue. Okay. So there was a specific poll question related to Microsoft conditional access and source IP restriction for SaaS application. One of the biggest challenge we learned from our customers when they use a legacy on prem secure web gateway or a cloud based secure web gateway, The challenge is a large range of egress IPs. When you use any Cloud based secure web gateway, the outbound IP is a large range. It's very difficult to whitelist the application. As part of the Cloudflare one zero trust solution, what we can do is we can provide a dedicated egress IP for your tenant. These public IPs are not shared with other Cloudflare customers. The advantage is whether you on ramp the traffic to Cloudflare using IPsec or a GRE tunnel or using a pack file or using a Cloudflare warp agent. When the traffic hits the closest Cloudflare data center, we understand who the user is, we apply the respective policy based on your organization security policy, and when we egress the traffic, we bind it to the dedicated egress IP attached to your company. So, typically, if you're using Salesforce or Microsoft or Google services, when the users users are protected by CloudFlare, we can ensure the outbound IP when they connect to Microsoft or Google or Salesforce or any SaaS application uses a specific public IP assigned to your tenant. Similar to the dedicated DNS resolver, we have the ability to assign your own IP as a dedicated Egress IP or CloudFlare has ability to provision dedicated Egress IP in all the three thirty five cities across the globe. That being said, I'll take a pass. I will go for a quick poll and then I will hand off to Aaron. Oh, to you, Aaron. Thank you, Gary. Appreciate it. And and thank you, team. As I said, if if you have any questions, feel free to post them in the q and a. So really, we're very lucky today that we have a customer that has gone down the zero trust journey. So Sam Fisher, I'll get you to introduce yourself really and and describe your role within, EREA flexible schools and the organization if you don't mind. Cheers. Thank you so much, Aaron and Gary for inviting me to come along today. So I represent, EREA Flexible Schools, so we're part of Edmund Rice Education Australia, and we focus on special assistance education. So we have 26 special and flexible school campuses located in six states and territories across Australia. When I say that to people, me, they're gonna say, What on earth is a flexi school? So a flexi school is a school for a young person who hasn't found success in a mainstream educational context, so that could be, you know, trauma, socioeconomic, mental health. Many of our young people could be on their third, fourth, or fifth chance of receiving an education, and this could be their last opportunity to have a school to go to. And our special schools are for young people with, mild to moderate, intellectual impairments. So having 26, school campuses across Australia, many of these are small schools and many of them are in regional areas to places like Alice Springs, right in the centre of Australia or Mount Isa, places that are, quite isolated and can often be challenging to support, not always from a tech perspective, but just logistically as well may be difficult to get to. So my role at, Flexi Schools is to be the national manager for IT solutions, so I lead IT platforms, infrastructure, business systems, and transformation. But my particular focus, over the last few years has been, modernizing our IT architecture and strategy. Perfect. Thanks, Sam. And and I'm not too sure if everyone on on within the webinar understands the geographic dispersion of Australia, but, you know, it can be very isolated and that can have a lot of challenges, especially when trying to deliver elearning or or or a stable learning platform for the students. So with that being said, in recent years, Sam, what have been the the IT and security priorities for ERA Flexible Schools, and and what business drivers were you actually looking to, to solve with going down that zero trust journey? So for us, we've had a pretty ambitious digital transformation agenda around, supporting modern teaching, learning, working, and collaboration. And what that's particularly about for us is supporting people using tech wherever they happen to be. So in a traditional schooling context, learning happens in a classroom. With our flexible schools, we have a lot of at special school, we have a lot of learning that's experiential. We have young people getting on buses, doing excursions, going and doing, you know, engaging in opportunities with First Nations people on traditional country and that kind of stuff. And also being a distributed group of small schools, we have a lot of specialists, national and regional staff who travel amongst schools. These people could be working, in all sorts of places, as could be young people who may be learning remotely as well. And building upon that too, we're also growing, we're looking at new sites, new opportunities to address unmet educational need, looking at how we can support remote learning. And when we consider this need to grow, particularly into some places that, you know, are really long distance away, like, I'm based in Brisbane, Australia, if I was to drive, to one of our furthest away school, it would take me seven days of driving to drive all the way to the other End Of Australia and then north to Geraldton, so there's some real scale and tyranny in that. To respond to that, we see, a cloud centric architecture being really critical to that. We don't wanna be maintaining large amounts of infrastructure, particularly given that we have lots of smaller distributed sites. We wanna move things to as a service as much as we can, so we do focus on delivering value rather than maintaining, you know, rooms full of things that make lots of noise and have flashing lights. And particularly in in the context of our network, our network architecture was, well, probably the last BigQuery architecture was about ten to fifteen years prior to us starting on this CloudFlare project. It was built around, you know, a fairly traditional and fairly common castle and mode design with, you know, active directory domain controllers at each site, file servers and all, and and building all the connectivity to make that sort of environment work, an environment that was very much built around. If you wanna use tech, go to school. And, you know, with maybe a client VPN as a bit of an afterthought if you happen to be working from home and need to access a file share. That was no longer meeting our requirements. We'd increasingly adopted SaaS. services, the files in Microsoft three sixty five, SharePoint, that kind of stuff. The experience was inconsistent for users when they weren't at a store or an office site. Ultimately, we wanna make sure that people can have a good and safe and secure experience with tech, no matter where they are, and also addressing some architectural constraints, that our legacy infrastructure had, like, being dependent on having fixed static IP addresses, which can be very difficult when your only connection option might be Starlink or four gs or five gs to get, a new. site open somewhere there's educational need. That's perfect, Sam. And and, look. I can imagine the challenges with with with, you know, having to, support such a broad geographic, dispersion, but also, you know, students in general are usually front of the line when it comes to technology savvy, and so security is actually really important because they'll always find a way. Right? And then that becomes quite unique to be able to to build an architecture that that addresses not just your unique dispersion, but also provides that holistic security. So one of the things I wanted to know and I guess our our attendees want to know is how did you begin evaluating vendors? And and and in those vendors, what qualities were you looking for? And finally, you know, what stood out about Cloudflare that was that that was unique for you? Yeah. We spent a lot of time considering, the kind of experience we wanted to deliver to our users, listening to the pain points, looking at, you know, where we're heading as an organisation. And there's some certain things that really stood out. One thing is the desire to have a good experience whether you're on-site or not, that idea of, you know, and also combining that with the desire that, you know, strengthen the security of that network makes some kind of zero trust network solution a pretty obvious starting point, but that's also got to support a national distributed regional footprint. For us, having a solution with something hosted in Sydney and trombone routing all our traffic through Sydney was not gonna cut the mustard for us, that we had schools very far away from Sydney and we can't say, hey, to be secure, you've gotta have really slow, high latency internet, that's not good enough for us. We wanted to have consistency in our management plan for users or devices on a zero trust environment versus those who may be connecting on-site, and that could include, you know, cases like an IoT network or a guest network or some kind of specialist infrastructure network segment like for print and a lot, we didn't wanna have multiple solutions to secure all that. Being in the education space, robust and accurate content filtering is really important. There are certain things that we not only need to safeguard a young person from seeing, but also know if they've been trying to stumble across that. And also, when we think about what growth might look like for us and in considering that, you know, learning and a lot of work is happening from the classroom, we needed flexibility in terms of the network hardware that we might retain on-site or having, you know, things that move like buses. There's a lot we kind of concluded pretty fast there was not gonna be one single network hardware vendor that was gonna offer, you know, something that might a good firewall for our biggest school and then something that's gonna be possibly installed in a bus or sit alongside a Starlink out in the desert somewhere that might sit on the same management plane. So trying to find a way to get some hardware agnosticism into our architecture was really important. And in the context of all those, that's where the, the CloudFlare, solution particularly stood out to us. Yeah. It's and and and I'm glad you mentioned that because as we touched on with the introduction, on ramps and the flexibility of on ramps. So we've not been able to not having to dictate hardware on-site, not having to dictate a message, a a means of of connecting is is really key to how we look to deliver our zero trust solution. And, also, you know, it's the age old thing, end user experience versus security. Right? So as you touched on here, pinning back through a remote data center to get access to something, that's that's what starts shadow IT, right, and and starts people looking for alternate methods, to to get access to the services they need. So I'm I'm glad that that resonated as well. But with your Cloudflare journey, how did you how did you get started deploying Cloudflare? And when you when when you're answering that, like, what services do you actually use from from Cloudflare? What's unique about those services? And then what the engagement model looks like and what things you did to working with Cloudflare obviously or on your own to help make things smoother. Really around how you got started. Yeah. So, we had a really interesting opportunity when we got started with Cloudflare. We had a school up in North Queensland that's about, yeah, 1,500 kilometres north of where I'm sitting right now who is really struggling with Internet connectivity. And what we we wanted to provide them a better solution, but we were constrained because the requirement for our legacy infrastructure was me to have a dedicated static public IPV4 address. The internet connectivity solution that made sense for them would be States and is Starlink, but Starlink. in the way of the quarter does not offer a dedicated IP address. So basically we had one of our most complicated use cases and went, let's try it here and see if we can get them connected. So right away, moving to using Cloudflare MagicLAN and the Magic Firewall as an on ramp into the Cloudflare Zero Trust environment, where does get rid of that constraint about having a public IP address and get started right away, delivering a really big win to some users who are really struggling with connectivity to the point where, you know, modern education requires connectivity and we'll be asked, can we even continue to run school here if the Internet doesn't work? We're able to address that right away. But broadly the solution that we've, deployed, and this goes back to what, Aaron and Yuri was saying about on ramps before, is we're using a combination of cloud player zero trust with a warp climb on end user devices, plus using Magic LAN and Magic Firewalls on ramp for our corporate, LAN into that same management plan of being able to apply the, firewall walls consistently at the, zero trust layer. Other things that we identified pretty early on that we wanted as part of that solution were things like having, dedicated DNS resolvers because we've got some scenarios where we I'm unable to have a dedicated IP address. We need to have very light infrastructure but still need to provide secure connectivity, so having those dedicated resolvers means we can apply at at targeted security policies to these devices because you know what can't accept the DNS server at this point? If you can't do DNS, you can't get on the Internet. Right? So Yep. in in terms of the kind of baseline scenarios that Cloudflare can address, it can even go down to the most, in a way, difficult lack of sophistication use cases right up to having a firewall we can connect to Magic LAN. And also using the dedicated, egress addresses as well so that we can integrate that with that conditional access policy to make sure that we target users with the right experience based on, you know, do we trust where they're connecting from? Because if they're connecting through zero trust and they've done all the authentication, then we're a lot more confident about who they are and what they're doing than if they're connecting from some random public IP address to which we can't have as much confidence about who they are and where they're coming from. Yeah. That's fantastic, Sam. And, it the dedicated DNS resolver, and Gary touched on it as well, and you've just mentioned it, is is is really powerful yet very easy to use. Right? So with just an IP address change and a DHCP scope or, you know, a DNS resolver IP change on Starlink, you're able to provide enforcement of what user what users can access on the Internet. So it's it's the ability to provide that without that dramatic architecture change, which is which is fairly fairly unique. Yeah. Being able to do that identification, you know, on the destination of the DNS request, Yeah. rather, also the request, it seems so simple, but in terms of what it delivers, it's an absolute game changer. Absolutely. So from your. experience, as you rolled out the Cloudflare solution, you know, obviously starting off with a small subset of users to try something and then pushing that deployment out across all your students and and faculty staff, you know, what sort of roadblocks did you run into or what sort of challenges did you have to overcome? Can you take us talk us a bit about, you know, that journey? Yeah. Absolutely. Being a nationally distributed organisation, we do have the benefit of being able to target different groups of users really easily, and so I set a challenge for the team. So once we get our school up in North Queensland, I said, next group of users we're gonna target is the head office, the CEO, the CFO, Yep. and COO, all those people sit. So what do we now need to do to continue to build this up, to get a level of confidence? So the IT team in practice was the next team that we deployed this to. The journey for us was that was, for the most part, reasonably straightforward. The documentation's pretty comprehensive. It's very easy to, you know, put some policies in place to test them to work out what rules and configurations work particularly well for us. One of the thing you're always gonna get, particularly if you wanna go fairly strict on security, and we did, we decided that we're gonna work on an inspection of TLS by default and then choose what we exempt. So you need to spend a bit of time, like, working out what bits of your infrastructure, what software just isn't gonna play nice with TLS inspection and go, are we okay with that? Yeah. What are we gonna exempt? It's obvious stuff to exempt Microsoft three six five. That's basically what Ticabox and Cloudflare does it, which is great, that, you know, keeps the performance of Teams calls and things like this really good. Otherwise, something else worth considering is all the different scenarios where our users are gonna be doing connectivity. So if we think about some of our people who are travelling or working remotely, you know, home WiFi, that's pretty straightforward, you know, people don't tend to have filtered home networks. What if you go if you're travelling, if you go to a hotel, if you're trying to join airport WiFi, we have staff for whom this is a necessity as part of their job. So we went through and tested all these different scenarios and, what was really awesome about that is it actually exceeded our expectations, we were worried about do we have to have, you know, show the CEO how to turn. Cloudflare off if something goes wrong. In fact, Cloudflare have been so actively developing their warped client that there's been a couple of times when we thought we found something, Next Patch fixed it. The experience with captive portals with in Qantas wifi that can be quite difficult thing. to get work from, we've travelled a lot around Australia, we can people can use wifi on planes and get their work done now which is pretty good. So for us it was about considering all those scenarios and testing it so with a goal that when we deploy this our users shouldn't notice any regression, they're just gonna notice, you know, the internet might be faster or more secure. And we're able to do a deployment to our national office with the slides and outages which over a firewall, the WARP client deployed silently to people's devices. We had people saying, hey, you said you were gonna do an upgrade to our devices, did you actually do it? They said, yeah, there's now a little orange cloud at the bottom of your computer near the clock or at the top of your on a Mac. And they're like, oh, I knew we didn't even notice it. So the source of this. that they didn't notice it was being deployed and right away we could see, you know, they were using it, the entries in the log files. No one complained, though, in fact the actual, the biggest bit of positive feedback we got was don't have to use an old VPN client anymore, we can just access everything from home if we wanna access that legacy file share, it just works. So being able to, you know, segment the users up and test each scenario really carefully was helpful. From there, we then picked one of the schools near down the road from the head office so that we could, you know, have some local people on-site to test it, you know, made sure we let. it run through basically the entire school term to get really confident, and then from there, we went, this is working, let's let it rip, and over the last, six months, we've now completed the deployment at the remaining 24 of our school sites. Well and that's that's quite a fast rollout, right, for for that geographic disperse, those geographic disperse users, students, locations. So proof of concept, validate what you what you wanted to achieve. Obviously, some tuning, some sites that our attendees may realize do cert pinning like Microsoft. They don't like things being, you to get in the way of that TLS handshake. So there's things like that that you'll find as you walk through deployments. And it's that's why it's important to to have a detailed scope as you start things out and then slowly rot it out. And to get to the point where, users didn't even notice a change other than improved, you know, Internet speeds and access to services. That's fantastic. So, really pleased with that. What about the after you've you went down the path of rolling out Cloudplay. I mean, you you've obviously got processes, you've got existing technologies, You know, you've there's, you know, there's existing VPN that was there. There is existing technologies, you know, change management, things like that. So it's obviously you know, we can talk around, you know, how how easy it was, but, as part of this, but there's obviously a process. Right? So what was your experience in depreciating those existing technologies? And also, you know, how do you bring in key stakeholders within the organization? Because, you know, there's some sometimes there's some very noisy stakeholders. So how do you bring them in, make sure that they're they're getting the journey rather than, you know, the teething problems and things like that? I suppose for us, it's always the approach we always take with transformation projects is to focus on the benefits that you're gonna get. So for us, not only is the Cloudflare Zero Trust solution a security uplift, and that's extremely important. Our board are very interested in us being able to demonstrate the journey we're on there, but, also, it's about the user experience. People don't like having to use you know, having to go manually sign in and out of VPNs. People don't like getting additional conditional access prompts when they take their MDN managed work device home. You know, they they they. should expect an experience on their device. So to be able to focus on, we're doing this to make your experience better and keep you safe, was something that was really important. But otherwise, we had a lot of runway to get this tested and get it right. So focusing on getting that communicating those key points, but also making sure that we'd done the homework, we'd done the testing, we'd considered, you know, scenarios like the CEO working in an airport lounge or, you know, trying to run a class off, you know, four gs connection and try and, you know, join, you know, a managed laptop to an iPhone hotspot or something like that, making sure all those, you know, weird and wonderful scenarios did work so that we could say with confidence, this is gonna make life better because we tested it thoroughly and we know it's gonna make things more secure, which means that people say, actually we want this for our school, we want this on our devices, which then means that this quietly comes in and then in a way the deprecation journey for the legacy infrastructure is for us basically getting rid of it. Essentially. Clare for us in the way we deployed it, it was not just about you know dropping the Warp Client on people's devices it was actually in a way it's become the backbone of our network is Cloudflare so as part of the migration journey we were you know replacing old firewalls with a fast simpler cloud managed firewall that essentially is tunneling all traffic to Cloudflare so we can bring everything straight into the zero trust environment to manage it there. So for us, Yeah. it was. a lot of work, but all things considered reasonably straightforward. Yeah. That's perfect. And there's certain obviously, we've got a very fast speed of innovation at Cloudflare, and you would have been right in the middle of, of one of the key things where we went from WARPs being WireGuard to being MASK. Right? And for those on the on the webinar, it's a proprietary tunneling protocol to just being HTTP free. Did that how how was that for ERA schools? It's been awesome, because the move to the mask protocol actually, right on its own, that eliminated any lingering issues we had with captive portals because it's the same technology out of the wood that services like iCloud Private Relay use. A lot of, you know, people have. tested their quality of calls with people using iPhones, so that's done a lot to improve the experience. And there's been quite a few changes where we've gone and read the release notes for WARP or the, you know, what's coming in Magicland. I'm like, oh, yeah. That's awesome for us. Another. example too that during one of our pilot appointments, we gave our players some feedback about the experience we had on shared Windows PCs and how there was a couple of limitations, and Gary was like, actually, just put the beta on. We're actually testing a fix for that right now, see how you go fix it right away. The beta was so stable, we ran it in production for a month or two to test it and make sure that worked and able to give Cloudplay that good feedback to commit that to production and stuff like that has happened pretty regularly, throughout the journey. So means there's a steady stream of updates, lots of release notes to read, but every time we see it in the door, that's awesome, that's gonna make stuff better for our users. So it's really great to see so much innovation and, you know, delivery of new features and experience improvements coming, with this stack of technology that we've adopted. Yeah. Thanks, Sam. And that's, it's great to see that that transition and especially you guys experiencing that transition as the technology innovates or, as we release new features and new features and functions. So what where what happens next for ERA flexible schools? So what what what next steps are you experiencing in your zero trust journey? So for us, we're now looking at how else can we get value out of this investment we've made. So one thing that we get that we didn't have before is the logging that CloudFlare gives us is fantastic and is detailed. And in an environment where we've got, you know, particular obligations to, you know, and a desire to to protect our young people, we have to look at those logs and go, hey, as a young person Googling something that is of concern to us so that we can redirect them and connect them with support services they need, that's really important. It's also giving us a baseline to be able to bring connectivity to places that we've never done before. We've got a project happening in one of our regional schools about, you know, the adoption of Starlink minis, which, Yep. the dedicated DNS resolvers are really important as part of that solution to make it really cost effective to get connectivity essentially in a desert in the middle of nowhere, looking at how we can deploy this to iPads and other devices that young people might take home and use to learn from anywhere. So there's quite a few exciting things that having Cloudflare as our base platform is now starting to enable for us, things that in the past we would've said, we actually can't do it due to technical limitations. Limitations now, you know, how much time do we have in our day to keep, you know, responding. to all our users to get them connectivity in places they could never have had it before? Yeah. That's fantastic. And, so I really appreciate, a real world and and your and your journey with with Cloudflare. It's been fantastic. So for anyone else that's on the call, so what advice would you give to others around getting started on their zero trust journey and specifically learnings around working with Cloudflare or getting getting started with Cloudflare? Honestly, the best way I find you can get started is to play with the free tier. The amount of stuff that you get in the free tier is pretty amazing. You get up to 50 users and let you do SSO. So you can really easily start having a play with this. To be honest, my first experience with this Cloudflare Zero Trust stuff was using the free tier on my home network because I wanted to access stuff from home when I was away from home. Some of my colleagues definitely ported at home as well to keep their kids safe and make sure they get a safe experience when. using their tech at home. But you could just as easily deploy that, you know, with a small team or a proof of concept group in your business, put the Warp, sign on your devices, build up some rules, test it, see how that experience goes. There's a huge amount of functionality and documentation that's very easy to access to have a play with and see, you know, is this gonna work for me? As we chose to, you know, scale it up, we can then bring in some of those enterprise solutions like, you know, MagicLAN and Magic Firewall, but a lot of that, you know, builds upon technology that you can play with and understand how it works that comes out of the free tier. And also too, we, had a really good journey with, a partner as well who helped us out with, you know, helping us, you know, build up and know that ad con. thing and scaling up fast, and we needed some extra assistance. So it's good that there's a network of partners out there that we can turn to as well, when we Yeah. That's fantastic, Sam. And, it's really important, you. know, it's good to get your your your thoughts on how to get started. One of the unique things that you touched on that Cloudflare has is what is the free plan. And so we have put into the chat the details of how to access the free plan. And so for anyone that's watching the webinar, please feel free to spin up your own tenant. You get access to, the zero trust portfolio and you get to try a lot of the stuff we've talked about. Sam, thank you very much for your time. It's been really, really fantastic to hear about your journey, you know, some of the, challenges you had, why you looked at Cloudflare, what are the the business outcomes, that you were looking for when you were looking to start the zero trust journey, and it's and it's fantastic for others to hear. The key is it's a partnership. Right? And so Cloudflare will work closely with with you as you evolve and as you go down that further down that zero trust journey, and we'll certainly, as we release more innovation like we have recently around our our Sassy for AI staff, which we've we've been speaking about off off off webinar is is is really key. So I'd like to just thank you again for coming on board, giving us your time, and feel free any last comments from you, Sam. Honestly, we've, and I'm not saying this is Cloudflare. NICE invited me to come into a webinar, but we've had a really good experience with deploying it, and it really has transformed, the kind of educational offerings we can offer because for us now, we're confident that if our CEO comes to us and points to anywhere on a map of Australia and says, could we open a school here? The answer is yes, and Cloudflare is a critical part of the stack that enables that for us. So that's been transformational for us, and and we've had a a great experience with it so far. So thanks, guys. No worries at all. And, that's so thank you again, Sam. Thank you, team, and for everyone that's taking the time out of to join us today. Hopefully, it's been, very valuable. You'll see in the chat there's links to certain things we've spoken about. If you have any questions or you'd like to reach out for for more information, by all means, feel free to do that. And once again, we thank you for your participation. It's, getting close to Christmas. So getting time out of people's days is getting harder and harder. So thank you once again, Sam, and thank you all for joining us. I hope it's been, informational. Thank you, Adam and Sam. Thank you all. Jeez. Thanks, everyone.