Consumer packaged goods · Public application portfolio
A consumer packaged goods company had a growing number of applications open to the public internet — customer portals, supplier interfaces, and tools for submitting information to regulators. These were the company's front door, and they were not consistently protected. Some sat behind Amazon's own web application firewall (AWS WAF), a service that filters out malicious web traffic. Others had been moved onto Cloudflare and used its protections instead, including encryption in transit (TLS), its own web application firewall, and defense against denial-of-service (DDoS) attacks, where attackers try to overwhelm a site with traffic until it goes down. The result was a patchwork: no two applications were guarded quite the same way.
This was a growing risk, because online threats keep getting more advanced. As new technologies and applications appear, so do new kinds of attacks — more automated bot traffic, larger denial-of-service attempts, and constant probing for weak spots. Defending each application differently meant some were well covered while others were left exposed, with no simple way to know which was which. Every new launch also took longer than it should, because the team worked out its internet defenses almost from scratch each time.
What the company really needed was one agreed standard for protecting anything exposed to the internet, rather than a fresh decision every time. That meant a clear baseline for the core defenses — the web application firewall, denial-of-service protection, and how traffic is allowed in (the “ingress” path, the route external requests take to reach an application) — built once and reused everywhere. The open question was whether to standardize on Amazon's built-in protections or use Cloudflare as a single, consistent layer in front of everything. Settling it called for a working, tested example, not just a recommendation on paper.
We designed and validated a reusable Cloudflare ingress pattern folding the strongest protections into one onboarding standard: Route 53 DNS with Cloudflare-proxied subdomains; WAF with the OWASP Core Rule Set; advanced rate limiting; bot management with managed challenges; DDoS protection at L3/L4 and L7; TLS terminated at Cloudflare and re-encrypted to ALB with mTLS; and origin protection locking ALB security groups to Cloudflare IP ranges.
Crucially, validation was evidence-based, not just configuration-based. We captured test outputs — curl with headers, dig for DNS, simulated bot patterns, rate-limit triggers — proving each control was live end to end, in a package built to satisfy both architecture review and audit.
Reusable ingress pattern adopted as the enterprise standard for public-facing apps
Cut new-app security design from 2–3 weeks to under 2 days
Early metrics: 90%+ reduction in known-bad bot requests reaching origin
Evidence-based validation package that holds up in architecture review and audit
Estimated annual engineering savings of $120K–$180K
A reusable, evidence-backed pattern beats a one-off design every time. Standardizing the edge didn't just harden the apps — it removed launch friction and gave the business something defensible to show customers and auditors without a fresh scramble each release.