Network Security & Cloud Transformation Roadmap
Existing Cloudflare Usage
CDN fremantleports.com.au — 20 TB/month
WAF App Security Advanced + Core (live)
DDoS Advanced DDoS — 20 TB global cap
Traffic Snapshot March 2026
45.4M
monthly requests on fremantleports.com.au
42M of those are automated bots
= 92% of all traffic is non-human
Today — Renewing 29 May 2026
Current Subscription
CDN
fremantleports.com.au — 20 TB/month
WAF
App Security Advanced + Core ruleset
DDoS Advanced
20 TB global scrubbing cap
Untapped Value
Cloudflare Tunnel
Included in your plan — not yet deployed. Secure access to Azure apps without VPN or exposed firewall rules.
This Proposal
Immediate Opportunities
Bot Management
92% of web traffic is bots. Stop scraping, credential stuffing and abuse before it reaches your origin — without impacting legitimate users.
API Shield
Discover, schema-validate and rate-limit API endpoints that are currently exposed and unprotected.
12-Month Road Ahead
Where This Takes You
Magic Transit
L3/L4 DDoS protection for OT systems, port infrastructure and all TCP/UDP services — BGP-announced from Cloudflare's network.
Spectrum
DDoS scrubbing and proxying for non-HTTP port applications without a full Magic Transit commitment.
Email Security
Inline phishing and BEC protection — complement or replace Microsoft Defender for inbound email threats.
🔒 Security Gaps
☁️ Cloud Migration
💰 Cost & Complexity
🏗️ Architecture Modernisation
🚢 Critical Infrastructure Risk
How Cloudflare transforms the Fremantle Ports security posture
🛡 Zero Trust Posture
Verify every user and device. Identity-aware policies replace implicit network trust.
🔥 DDoS at Every Layer
L3/L4 via Spectrum, L7 via WAF. 321 Tbps capacity absorbs attacks at the edge.
🔐 API-First Security
Positive security model blocks schema violations at edge. Already activated free.
🤖 Bot Intelligence
ML scoring on every request. 42M monthly bots managed without affecting real users.
📩 Email Protection
Phishing, BEC and malware stopped before M365. Retroactive post-delivery remediation.
🔒 Origin Concealment
Azure and port system IPs never exposed. Attack surface reduced to Cloudflare’s network.
Cost Reduction
Operational Efficiency
Cloud Enablement
Business Resilience
Network-level DDoS protection for Fremantle Ports IP infrastructure
Network-Level DDoS Protection
L3/L4 mitigation for the entire Fremantle IP prefix — volumetric attacks absorbed at Cloudflare’s edge before ever reaching the network.
BGP Prefix Advertisement
Cloudflare announces Fremantle’s IP ranges via anycast. Traffic is automatically routed to the nearest CF point of presence globally.
321 Tbps Absorption Capacity
The world’s largest DDoS mitigation network. Even the largest volumetric attacks are absorbed without impacting port operations.
No Infrastructure Changes
Works alongside existing NextDC and Inland Feunix infrastructure. Clean traffic returned to Fremantle via GRE tunnel or CNI.
Cloudflare Email Security augmenting Microsoft 365
Option 1 — Inline (MX Change Required)
Pre-delivery blocking — threats never enter M365
Option 2 — API Mode (No MX Change)
Zero disruption — deploy in hours via Microsoft Graph API
Threat Detection Engine
API Mode — Microsoft Graph
Link & Attachment Protection
Deployment Flexibility
92%
of payload-based phishing
attacks blocked by Cloudflare
<24h
to deploy via API mode
with zero change management
$0
disruption to mail delivery
with API mode deployment
Why Fremantle Ports Is a Target
Fremantle Ports handles high-value cargo movements, vessel scheduling, and government reporting — all prime BEC targets. A single phishing compromise can trigger wire fraud, regulatory breach, or operational disruption.
Recommended Approach
Start with API mode — immediate visibility, no disruption. Analyse threat data for 30 days, then evaluate inline mode for full pre-delivery protection. Complements and strengthens the existing Microsoft Defender investment.
TCP/UDP application protection for port operations systems
DDoS Protection (L3/L4)
IP Firewall & Access Rules
Origin IP Concealment
Rate Limiting & Logging
321Tbps
Cloudflare network capacity
to absorb DDoS attacks
100%
origin IP concealment
for PSL, R2S & RASA
Any
TCP/UDP protocol
no HTTP requirement
Why Fremantle Ports Needs This
Port management systems (PSL, R2S, RASA) operate on custom TCP/UDP protocols not covered by traditional web WAFs. A DDoS attack on these systems could halt vessel scheduling, cargo tracking, or regulatory reporting — with direct financial and operational impact.
Critical Infrastructure Protection
As critical national infrastructure, Fremantle Ports is a high-value target. Spectrum provides DDoS resilience and IP concealment with no changes to existing server configurations — protecting core port systems while maintaining full operational continuity.
Secure Azure connectivity — no public IPs, no inbound firewall rules
Outbound-Only Tunnel
Zero Trust / CF Access
WARP Client (Remote Workers)
WAF & DNS in the Path
Zero
public IPs required
on any Azure server
Zero
inbound NSG / firewall
rules to manage in Azure
↓ Cost
Checkpoint VPN eliminated
for all Azure-hosted apps
Enables the Azure Migration
As Fremantle Ports migrates applications to Azure, Cloudflare Tunnel provides the secure connectivity layer — without public IPs, complex firewall rules, or expensive dedicated circuits. On-prem infrastructure continues working unchanged during migration.
Secure Remote Access Without VPN
Port staff working remotely connect through WARP to access Azure applications securely — no VPN client, no split tunnelling headaches, no hardware to manage. Identity-aware policies ensure only the right people reach the right systems.
Layered application security — already protecting fremantleports.com.au
OWASP & Managed Rulesets
L7 DDoS Protection
Custom Rules & Transform Rules
Already Live at Fremantle Ports
API Discovery Already Active
Schema Validation (Positive Security)
Auth & JWT Validation
The Fremantle Ports Bot Problem
42M
of 45.4M monthly
requests are bots
= 92% of all traffic is non-human. Consuming origin resources, skewing analytics, and creating credential stuffing and scraping risk with no dedicated bot product in place today.
How Bot Management Works
Protect Origin Performance
Eliminate junk traffic load. Reduce origin infrastructure costs and improve real-user page speed significantly.
Accurate Analytics
With bots filtered, analytics reflect real human traffic — enabling better data-driven decisions for the business.
Stop Account Takeover
Credential stuffing uses leaked passwords. Bot Management + Leaked Credentials detection stops ATO before it succeeds.
Email Security
Stops phishing, BEC, and malware before they reach staff inboxes — augments Microsoft Defender with no disruption to mail flow via API mode.
Spectrum
L3/L4 DDoS protection and origin IP concealment for port operations systems (PSL, R2S, RASA) running on custom TCP/UDP protocols.
Cloudflare Tunnel
Secure connectivity to Azure-hosted apps with no public IPs or inbound firewall rules. Replaces Checkpoint VPN and enables Zero Trust remote access.
WAF + API Shield
OWASP Top 10 protection plus a positive security model for APIs. Already active — endpoint discovery data is ready to tune with the cyber team.
Bot Management
ML-based scoring eliminates the 42M monthly bot requests consuming origin resources, skewing analytics, and creating credential stuffing risk.
Magic Transit
Network-level DDoS protection for Fremantle’s entire IP prefix. Announces BGP routes via Cloudflare — volumetric attacks absorbed at the edge before reaching the network.