Defeating the deepfake: stopping laptop farms and insider threats (opens in new tab)

Trust is becoming a critical security weakness as attackers use stolen identities, AI-generated deepfakes, and laptop farms to impersonate remote workers. Traditional zero trust controls verify devices and credentials but often fail to verify the actual person behind them. Cloudflare’s partnership with Nametag adds identity verification during onboarding and risk-based controls afterward, aiming to prevent fraudulent workers from accessing corporate systems.

The Rise of Remote Worker Fraud

• Organized groups, including North Korean operations, use “laptop farms” to infiltrate companies.
• Devices are shipped to domestic addresses, physically connected to KVM switches, and remotely operated by fraudulent workers.
• Attackers use stolen identities, generative AI for interviews, and deepfake tools to create convincing government IDs and selfies.
• Valid credentials and corporate-issued devices can make these users appear legitimate to standard zero trust systems.

Why Traditional Insider Threat Defenses Fall Short

• DLP and UEBA tools typically detect suspicious behavior only after an attacker has gained access.
• Conventional onboarding often trusts:
  • The identity provided by a new hire
  • The shipping address receiving the laptop
  • Credentials sent to a personal email address
• Zero trust policies commonly verify device posture, location, and account permissions—but not whether the person is genuinely the employee.

Identity-Verified Zero Trust

• Cloudflare Access is adding Nametag’s workforce identity verification to its existing policy checks.
• Nametag verifies that the person receiving, configuring, and using a device is:
  • A real person
  • The legitimate person named in the identity documents
  • The authorized employee
• Verification occurs before access to email, code repositories, or other internal resources is granted.

How the Nametag Integration Works

• Nametag integrates with Cloudflare Access through OpenID Connect (OIDC).
• It can operate as the primary identity provider or as an additional evaluation factor alongside Okta or Microsoft Entra ID.
• A typical onboarding flow includes:
  • The user attempts to access an onboarding portal.
  • Cloudflare redirects them to Nametag.
  • The user provides a work email, takes a selfie, and scans a government-issued ID.
  • Nametag’s Deepfake Defense technology uses cryptography, biometrics, and AI to detect fake identities, injection attacks, and presentation attacks such as printed photos.
  • A successful verification returns an ID token to Cloudflare, which applies its Access policies.
• The process reportedly takes less than 30 seconds, and biometrics are not retained afterward.

Layered Insider Threat Protection

• Identity verification complements Cloudflare’s existing controls:
  • API-driven DLP for detecting data exfiltration
  • Remote Browser Isolation for reducing browsing risks
  • Shadow IT reporting and CASB capabilities for identifying unmanaged services and misconfigurations
• Together, these controls distinguish between knowing which account is connecting and knowing who is actually behind the keyboard.

Continuous Verification

• Initial identity checks are not sufficient because legitimate credentials can later be sold or compromised.
• Cloudflare Access uses user risk scores to support context-aware policies.
• A sudden increase in risk can trigger access revocation for one or multiple applications.

Organizations facing remote hiring and insider-threat risks should supplement device and credential verification with strong identity assurance at onboarding, followed by continuous, risk-based monitoring.