Cloudflare has acquired BastionZero, a zero-trust infrastructure access platform provider, to bolster its zero-trust network access (ZTNA) and secure access service edge (SASE) capabilities. The financial terms were not disclosed.

Cloudflare claims the BastionZero integration extends its ZTNA capabilities with native access management for infrastructure like servers, Kubernetes clusters and databases.

BastionZero offers a platform for passwordless access to Kubernetes, server, web and database infrastructure based on the zero-trust principles. The startup claims it delivers this access without creating a single point of compromise by pairing with customers’ existing identity provider (IdP) to quickly grant access with policy controls and observability — without a mess of passwords, VPNs, and secure shell (SSH) keys.

After joining Cloudflare, the BastionZero team will be focused on integrating their infrastructure access controls directly into Cloudflare One, which is the vendor’s single-vendor SASE platform.

Launched in 2020, the Cloudflare One SASE platform includes gateway secure web gateway (SWG), cloud access security brokers (CASBs) and ZTNA capabilities. The solution offers network edge capabilities through its Magic WAN SD-WAN alternative along with its Network On-Ramp partnerships with SD-WAN vendors. Cloudflare’s SASE is built on its extensive backbone and global network, which operates in 300 cities in over 100 countries and interconnects 12,500 networks.

Cloudflare is expected to roll out a number of new features for zero-trust infrastructure access via Cloudflare One based on the integration during the third and fourth quarters of this year.

“Cloudflare already runs the world’s largest SASE network and millions of organizations trust Cloudflare to protect their systems and data,” Nitin Rao, interim chief product officer at Cloudflare, told SDxCentral in an email. “The addition of BastionZero’s zero-trust technology will allow our customers to further replace VPNs beyond apps and networks and into infrastructure.”

BastionZero fits in Cloudflare’s SASE, ZTNA

Cloudflare has been making strides to help organizations of any size replace their VPNs with ZTNA and the vendor claims the BastionZero deal expands the scope and centralizes the management.

“Together, Cloudflare and BastionZero can help organizations replace not only VPNs but also bastion hosts; SSH [secure shell], Kubernetes, or database key management systems; and redundant PAM [privileged access management] solutions,” Cloudflare said in a blog post.

The company claims BastionZero will add several capabilities to its SASE platform including the following:

• Modernized credential management: By eliminating long-lived keys and credentials, BastionZero uses PAM capabilities to simplify credential management for SSH keys, kubeconfig files and database passwords through a new decentralized approach.
• Enhanced SSH security: Adopting a DevOps-based approach, BastionZero secures SSH connections to support least privilege access. It records every session and command for better visibility and compliance.
• Clientless desktop access: The Cloudflare and BastionZero integration supports clientless remote desktop protocol (RDP), allowing users to access desktop environments without the need to install a client on a user’s device.