Pure hosted introducing CloudflarePure hosted introducing Cloudflare

Short summary:

• This announcement only applies to customers with Pure instances hosted by Elsevier
• Pure will be getting new IP addresses, and these will no longer be considered static, as we expect Cloudflare to continously change them
• Pure Portal campus restricted content using inbound IP based allow-list filtering, is not affected

Elsevier is introducing Cloudflare WAF (Web Application Firewall) of your hosted Pure availale for all customers in May 2024.

Practically this change requires no action by Pure customers and will be applied gradually during February to May of 2024.  

WAF is highly effective and it can provide multiple benefits for Pure security and performance.  

WAF can help: 

• Increase protection of sensitive data, such as customer records and prevent leakage. WAF can filter out malicious requests that try to steal or tamper with your data
   
• Increase mitigation of threats before they reach Pure. WAF can block malicious traffic and requests that try to exploit vulnerabilities undiscovered by the Pure team, such as SQL injection, cross-site scripting, or denial-of-service attacks.
   
• Increase protection against malicious applications and DDOS attacks by specifically checking HTTP and network requests. WAF can inspect the content and parameters of each HTTP request and response and apply granular rules and policies to allow or deny access based on various criteria, such as source IP, user agent, cookie, header, method, or payload. 
   

Clarification of message made on January 6th concerning allow-listing via IP for Pure:

• When Pure implements Cloudflare the IP range Pure is hosted on changes from a specific range of only 4 addresses, to a vastly larger and dynamically changing IP range
   
• This means that if you as a customer currently apply allow-listing based on IP from your corporate network against Pure IP's, this will no longer be possible
   
• However, unchanged and still available, is that some customers have configured Pure to restrict access to certain parts of Pure, only for IP requests coming from your corporate network. E.g. campus IP restricted portal showing content with campus visibility in Pure