Skip to content

Commit dacdd1a

Browse files
dcpenadcpena
committed
Adding content for implementation guide
1 parent 6cb49cf commit dacdd1a

File tree

23 files changed

+564
-0
lines changed

23 files changed

+564
-0
lines changed

‎src/assets/images/learning-paths/holistic-ai-security/ai-app-type-app-library.png‎

118 KB
Loading

‎src/assets/images/learning-paths/holistic-ai-security/casb-posture-findings-openai.png‎

88.5 KB
Loading

‎src/assets/images/learning-paths/holistic-ai-security/custom-coaching-page.png‎

75.1 KB
Loading

‎src/assets/images/learning-paths/holistic-ai-security/gateway-prompt-log.png‎

43.2 KB
Loading

‎src/assets/images/learning-paths/holistic-ai-security/shadowit-dashboard-ai-apps.png‎

252 KB
Loading

‎src/content/docs/learning-paths/holistic-ai-security/appendix/index.mdx‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
title: Appendix
3+
pcx_content_type: overview
4+
sidebar:
5+
group:
6+
hideIndex: true
7+
order: 6
8+
---
9+

‎src/content/docs/learning-paths/holistic-ai-security/appendix/workers-create-custom-coaching-pages.mdx‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
---
2+
title: Use Cloudflare Workers to create custom user coaching pages
3+
pcx_content_type: overview
4+
sidebar:
5+
label: Use Cloudflare Workers to create custom user coaching pages
6+
order: 2
7+
---
8+
9+
Cloudflare Workers are an easy method to stand up custom user coaching pages. The customs status pages can be handled dynamically based on the information that Gateway sends about a blocked request.
10+
11+
## Example
12+
13+
```
14+
const COMPANY_NAME = "Your Company Inc.";
15+
const APPROVED_TOOL_URL = 'https://chat.yourcompany.com'; // Your sanctioned AI tool URL
16+
const APPROVED_TOOL_NAME = 'Corporate AI Assistant'; // The user-friendly name of your tool
17+
const IT_HELPDESK_EMAIL = '[email protected]'; // Email for the "report a problem" button
18+
const COMPANY_LOGO_URL = 'Your_Logo.svg'; // A publicly accessible URL for your company logo. Replace with your own.
19+
20+
export default {
21+
async fetch(request) {
22+
// 1. Get the blocked URL from the query string passed by Gateway.
23+
const url = new URL(request.url);
24+
const blockedUrlParam = url.searchParams.get('blocked_url');
25+
26+
// Decode and sanitize the blocked URL for display.
27+
let blockedHostname = "the requested site";
28+
let fullBlockedUrl = "an unapproved external tool";
29+
if (blockedUrlParam) {
30+
try {
31+
const decodedUrl = decodeURIComponent(blockedUrlParam);
32+
fullBlockedUrl = decodedUrl;
33+
blockedHostname = new URL(decodedUrl).hostname;
34+
} catch (e) {
35+
// If the URL is malformed, use the raw param safely.
36+
fullBlockedUrl = blockedUrlParam;
37+
blockedHostname = blockedUrlParam;
38+
}
39+
}
40+
41+
// 2. Prepare the "Report a problem" mailto link.
42+
const mailtoSubject = Business Justification for AI Tool: ${blockedHostname};
43+
const mailtoBody = `Hello IT/Security Team,
44+
45+
I was attempting to access the following website and was redirected to this coaching page:
46+
${fullBlockedUrl}
47+
48+
My business justification for needing this specific tool is:
49+
[**Please describe your business need here**]
50+
51+
Thank you,
52+
[Your Name]`;
53+
54+
const mailtoLink = mailto:${IT_HELPDESK_EMAIL}?subject=${encodeURIComponent(mailtoSubject)}&body=${encodeURIComponent(mailtoBody)};
55+
56+
// 3. Generate the full HTML page.
57+
const html = generateHTML(blockedHostname, mailtoLink);
58+
59+
// 4. Return the HTML as a response.
60+
return new Response(html, {
61+
headers: {
62+
'Content-Type': 'text/html;charset=UTF-8',
63+
},
64+
});
65+
},
66+
};
67+
68+
/**
69+
* Generates the full HTML for the coaching page.
70+
* @param {string} blockedHostname - The hostname of the site the user tried to access.
71+
* @param {string} mailtoLink - The pre-built mailto link for reporting an issue.
72+
* @returns {string} - The complete HTML document as a string.
73+
*/
74+
function generateHTML(blockedHostname, mailtoLink) {
75+
// Using a template literal for easy-to-read HTML with embedded variables.
76+
return `
77+
<!DOCTYPE html>
78+
<html lang="en">
79+
<head>
80+
<meta charset="UTF-8">
81+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
82+
<title>AI Tool Usage Policy</title>
83+
<style>
84+
:root {
85+
--primary-color: #00529B;
86+
--secondary-color: #0078D4;
87+
--background-color: #f4f6f8;
88+
--text-color: #333;
89+
--card-bg-color: #ffffff;
90+
--button-primary-bg: #0078D4;
91+
--button-primary-hover: #005a9e;
92+
--button-secondary-bg: #e0e0e0;
93+
--button-secondary-hover: #c7c7c7;
94+
--button-text-color: #ffffff;
95+
--button-secondary-text: #333;
96+
}
97+
body {
98+
font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
99+
background-color: var(--background-color);
100+
color: var(--text-color);
101+
margin: 0;
102+
display: flex;
103+
justify-content: center;
104+
align-items: center;
105+
min-height: 100vh;
106+
padding: 20px;
107+
box-sizing: border-box;
108+
}
109+
.container {
110+
background-color: var(--card-bg-color);
111+
border-radius: 8px;
112+
box-shadow: 0 4px 12px rgba(0,0,0,0.1);
113+
max-width: 600px;
114+
width: 100%;
115+
text-align: center;
116+
padding: 40px;
117+
border-top: 5px solid var(--primary-color);
118+
box-sizing: border-box;
119+
}
120+
.logo {
121+
max-width: 150px;
122+
margin-bottom: 24px;
123+
}
124+
h1 {
125+
color: var(--primary-color);
126+
font-size: 24px;
127+
margin-bottom: 16px;
128+
}
129+
p {
130+
font-size: 16px;
131+
line-height: 1.6;
132+
margin-bottom: 24px;
133+
}
134+
.highlight {
135+
font-weight: bold;
136+
color: var(--text-color);
137+
}
138+
.button-container {
139+
display: flex;
140+
flex-direction: column;
141+
gap: 12px;
142+
margin-top: 32px;
143+
}
144+
@media (min-width: 600px) {
145+
.button-container {
146+
flex-direction: row;
147+
justify-content: center;
148+
}
149+
}
150+
.button {
151+
display: inline-block;
152+
padding: 12px 24px;
153+
border-radius: 5px;
154+
text-decoration: none;
155+
font-weight: bold;
156+
font-size: 16px;
157+
transition: background-color 0.2s ease;
158+
cursor: pointer;
159+
border: none;
160+
}
161+
.button-primary {
162+
background-color: var(--button-primary-bg);
163+
color: var(--button-text-color);
164+
}
165+
.button-primary:hover {
166+
background-color: var(--button-primary-hover);
167+
}
168+
.button-secondary {
169+
background-color: var(--button-secondary-bg);
170+
color: var(--button-secondary-text);
171+
}
172+
.button-secondary:hover {
173+
background-color: var(--button-secondary-hover);
174+
}
175+
</style>
176+
</head>
177+
<body>
178+
<div class="container">
179+
<img src="${COMPANY_LOGO_URL}" alt="${COMPANY_NAME} Logo" class="logo">
180+
<h1>Access to this AI Tool is Restricted</h1>
181+
<p>
182+
You were redirected to this page because your attempt to access <span class="highlight">${blockedHostname}</span>
183+
was blocked by our company's security policy.
184+
</p>
185+
<p>
186+
To protect our company's confidential data, intellectual property, and customer information, we must ensure that AI tools are used responsibly. Unapproved tools may pose risks related to data privacy, security, and licensing.
187+
</p>
188+
<p>
189+
We encourage you to use our officially approved and secure solution, the
190+
<span class="highlight">${APPROVED_TOOL_NAME}</span>, for your business needs.
191+
</p>
192+
<div class="button-container">
193+
<a href="${mailtoLink}" class="button button-secondary">Report a Problem</a>
194+
<a href="${APPROVED_TOOL_URL}" class="button button-primary">Use Approved Tool</a>
195+
</div>
196+
</div>
197+
</body>
198+
</html>
199+
`;
200+
}
201+
```
202+
203+
If successful, your custom user coaching page will look like the image below. It will appear anytime a user attempts to access an unapproved AI tool.
204+
205+
![Exmaple of a custom coaching page utilizing the code example above.](~/assets/images/learning-paths/holistic-ai-security/custom-coaching-page.png)

‎src/content/docs/learning-paths/holistic-ai-security/build-security-policies/index.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
title: Build security policies for general AI use
3+
pcx_content_type: overview
4+
sidebar:
5+
label: Overview
6+
order: 4
7+
---
8+
9+
Once your monitoring tools have given you a clear picture of AI usage in your organization, you can begin building security policies to meet your objectives. The Gateway policy builder offers extensive options for both application categorization and function granularity to help you create policies that achieve your goals.
10+
11+
You should build security policies based on the perceived risk level, potential for data leaks, and your organization's confidence in a tool. For instance, if you approved Google Gemini for your corporate use, you may apply different policies to it than you would to other AI applications. This section will detail the types of policies Cloudflare recommends for securing AI tools in your organization.

‎src/content/docs/learning-paths/holistic-ai-security/build-security-policies/set-policy-approval.mdx‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
title: Set policy based on approval status
3+
pcx_content_type: overview
4+
sidebar:
5+
label: Set policy based on approval status
6+
order: 1
7+
---
8+
9+
If you use specific AI tools within your organization, you may want to create policies to explicitly allow the usage of those tools while continuing to evaluate additional usage within your organization.
10+
11+
## Create a Gateway policy for monitoring and evaluating all AI tool usage
12+
13+
1. In [**Zero Trust**](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
14+
2. In the **HTTP** tab, select **Add a policy**.
15+
3. Name the policy.
16+
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow for AI at your organization.
17+
18+
| Selector | Operator | Value |
19+
| -------- | -------- | ----- |
20+
| Application | in | *Artificial Intelligence* |
21+
22+
5. For **Action**, select **Allow**.
23+
6. Select **Create policy**.
24+
25+
For more information, refer to [Block unauthorized applications](/cloudflare-one/policies/gateway/http-policies/common-policies/#block-unauthorized-applications).
26+
27+
## Create a Gateway policy to redirect users towards approved AI tools
28+
29+
Conversely, you can build policies that take specific actions based on an AI tool's approval status. For example, if you want to redirect users from unapproved applications to approved applications, you can create custom status pages to provide user coaching.
30+
31+
User coaching is a valuable tool for encouraging employees to change their behavior. By redirecting users to a status page, you can help them understand the risks of using unsanctioned AI tools and educate them on the dangers of inputting sensitive data.
32+
33+
Cloudflare Workers are an easy method to stand up custom user coaching pages. The customs status pages can be handled dynamically based on the information that Gateway sends about a blocked request. In the appendix of this document, you can find sample code for a Cloudflare Worker built for this purpose that you can test and adopt if desired.
34+
35+
## Redirect users towards approved AI tools
36+
37+
1. In [**Zero Trust**](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
38+
2. In the **HTTP** tab, select **Add a policy**.
39+
3. Name the policy.
40+
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow for AI at your organization.
41+
42+
| Selector | Operator | Value |
43+
| -------- | -------- | ----- |
44+
| Application | in | *Artificial Intelligence* |
45+
46+
5. For **Action**, select **Block**.
47+
6. To **Modify the Gateway block behavior**, determine how you want to redirect your users.
48+
- Redirect users to a custom block page to coach the user:
49+
1. Select **Use account-level block setting**.
50+
2. Check **Add an additional message to your custom block page when traffic matches** this policy and enter your custom message.
51+
- Redirect users to an approved AI tool automatically:
52+
1. Select **Override account setting with URL redirect**.
53+
2. Enter the URL to the approved application you want to redirect the user to use instead.
54+
7. Select **Create policy**.
55+
56+
For more information, refer to [Configure policy block behavior](/cloudflare-one/policies/gateway/block-page/#configure-policy-block-behavior).
57+
58+
## Capture prompts to prevent data loss
59+
60+
You can build policies that enable Prompt Capture for AI applications in specific, complex scenarios. This gives you the flexibility to apply advanced functionality to certain applications, tool types, or user groups, such as contractors or new employees, especially if they pose a higher risk for using unsanctioned applications due to lack of awareness or training.
61+
62+
1. In [**Zero Trust**](https://one.dash.cloudflare.com/), go to **Gateway** > **Firewall policies**.
63+
2. In the **HTTP** tab, select **Add a policy**.
64+
3. Name the policy.
65+
4. Under **Traffic**, build a logical expression that defines the traffic you want to allow for AI at your organization.
66+
67+
| Selector | Operator | Value |
68+
| -------- | -------- | ----- |
69+
| Application | in | *Artificial Intelligence* |
70+
71+
5. Under **Identity**, build a logical express that defines the user identity you want to capture and log their prompts to review for data loss prevention.
72+
73+
| Selector | Operator | API Value |
74+
| -------- | -------- | ----- |
75+
| Application | in | `any(identity.groups.name[*] in {\"contractors\" \"cohort-224\"})`|
76+
77+
6. For **Action**, select **Allow**.
78+
7. Select **Create policy**.
79+
80+
## Order your policies for specific inspection and enforcement
81+
82+
In most scenarios, Gateway evaluates HTTP policies in [top-down order](/learning-paths/secure-internet-traffic/understand-policies/order-of-enforcement/).
83+
Therefore, you can capture prompts in specific scenarios to gain visibility without disrupting your users' work, all while holistically protecting against sensitive data loss.
84+
85+
For example, if you want to prevent sensitive data being shared with AI but want to allow all users to use AI but capture the prompts for specific identity-defined user groups, you would need to order your policies in the following way.
86+
87+
1. The policy that blocks sensitive data being shared would need to be ordered first in this policy group. This will allow it to be enforced before the next policy in the policy group.
88+
89+
| Operator | Selector | Operator | Value | Action |
90+
| -------- | -------- | -------- | ----- | ------ |
91+
| | Application | in | *Artificial Intelligence* | |
92+
| And | DLP Profile | in | *my-sensitive-data* | Block |
93+
94+
2. Next, create the policy that allows the use of AI and specifies the prompt capture for specific user groups.
95+
96+
| Selector | Operator | Value |
97+
| -------- | -------- | ----- |
98+
| Application | in | *Artificial Intelligence*|
99+
100+
3. Under **Traffic**:
101+
102+
| Selector | Operator | Value|
103+
| -------- | -------- | ------ |
104+
| Application | in | *Artificial Intelligence*|
105+
106+
4. Under **Identity**:
107+
108+
| Selector | Operator| API Value | Action |
109+
| -------- | -------- | -------- | ------ |
110+
| User Group Names | in | `any(identity.groups.name[*] in {\"contractors\" \"cohort-224\"})`| Allow |
111+
112+
By structuring your policies in this way, you ensure that any instance of sensitive data is blocked from AI applications, no matter which user group is involved. If Cloudflare does not detect sensitive data, it will allow the prompt while capturing it for the targeted user groups–in this case, users belonging to the `contractors` and `cohort-224` groups. If that same user group were to then use sensitive data in a prompt, it would be detected and blocked.

‎src/content/docs/learning-paths/holistic-ai-security/concepts/index.mdx‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
title: Concepts
3+
pcx_content_type: overview
4+
sidebar:
5+
label: Overview
6+
order: 1
7+
---
8+
9+
The goal of this learning path is to provide Cloudflare One users with the strategy and tools to securely adopt generative AI within their organizations. This guide will help address new security challenges and mitigate risks like shadow AI and data loss.
10+
11+
## Objectives
12+
13+
- Determine risk tolerance: Identify areas of concern and risk tolerance for AI use to establish a baseline for your organization's AI security strategy.
14+
- Monitor AI usage: Utilize Cloudflare One's tools, such as the Shadow IT dashboard and API CASB integrations, to gain visibility into both sanctioned and unsanctioned AI application usage.
15+
- Build security policies: Create granular security policies using Cloudflare Gateway to control AI usage, prevent data loss with DLP, and manage user behavior through actions like blocking or redirecting.
16+
- Secure sanctioned models: Apply Zero Trust principles to sanctioned AI models and internal services like Model Context Protocol (MCP) servers to ensure secure access and protect sensitive data from being exposed
17+

0 commit comments

Comments
 (0)