Secure Access Service Edge (SASE) is a cloud architecture model that integrates network and security-as-a-service functions into a single cloud service. Conceptually, SASE extends networking and security capabilities beyond traditional boundaries. This allows remote workers to benefit from firewall as a service (FWaaS), secure web gateway (SWG), zero-trust network access (ZTNA), and a variety of threat detection functions.
The term SASE (pronounced “sassy”) was first described by Gartner in an August 2019 report called, “The Future of Network Security in the Cloud.” It is designed the address the needs of highly distributed and cloud-dependent work environments.
When effectively implemented, a SASE approach ensures secure access for businesses regardless of the location of their users, workloads, devices, or applications. This is crucial for maintaining the security of remote workers. With the rapid adoption of SaaS (Software as a Service) applications and the swift movement of data across data centres, branch offices, and hybrid– and multi-cloud environments, SASE facilitates safe browsing and secure access to both corporate and SaaS applications from any location.
SASE offers:
Enhanced Security
- Delivers consistent security policies across all users, devices, and locations.
- Implements Zero Trust principles to minimise the attack surface.
Improved Performance
- Direct-to-cloud connections minimise latency, particularly for remote workers.
- Intelligent traffic routing guarantees quick and reliable access to essential applications.
Simplified Management
- Consolidates networking and security functions into one solution, reducing complexity.
- Easier to manage than multiple, siloed solutions.
Scalability
- Cloud-based delivery allows for seamless scaling as the business grows or evolves.
Cost Efficiency
- Reduces the need for expensive on-premises hardware and maintenance.
- Pay-as-you-go models align costs with actual usage.
- Zero Trust Network Access (ZTNA): This technology ensures that every time someone or something tries to access a network, they are verified. It assumes threats can be anywhere, so it sets up secure, one-to-one connections and requires regular re-verification.
2. Secure Web Gateway (SWG): An SWG filters and blocks harmful web traffic to protect data and prevent cyber threats. It’s useful for securing remote and hybrid work environments.
3. Cloud Access Security Broker (CASB): A CASB helps keep data secure when using cloud services and applications by providing visibility and control over these services.
4. Software-Defined WAN (SD-WAN) or WAN-as-a-Service (WANaaS): These technologies connect and manage operations across large distances.
- SD-WAN uses software and a central controller to simplify network management.
- WANaaS minimises hardware at physical locations and uses the internet to connect to the nearest service point, reducing costs and improving performance.
5. Next-Generation Firewall (NGFW): An NGFW provides advanced security by inspecting data more deeply than traditional firewalls. It can identify and block hidden threats and can be deployed in the cloud as a service.
Security Service Edge (SSE) is a cloud-based security service that ensures safe browsing, secure access to private applications, and SaaS applications. It includes:
- Firewall-as-a-Service (FWaaS): Provides advanced firewall features like intrusion prevention, anti-malware, web security, and more, all through the cloud.
2. Secure Web Gateway (SWG): Monitors and secures web activity, enforcing safe browsing with features like data loss prevention, SSL inspection, and URL filtering.
3. Zero-Trust Network Access (ZTNA): Offers secure remote access to specific applications and services based on strict access control policies, unlike VPNs which grant access to entire networks.
4. Cloud Access Security Broker (CASB): Manages and secures the use of cloud services by setting and enforcing policies, either by controlling application access or checking content in cloud apps.
So how does SASE differ from SSE?
SASE includes components such as SD-WAN, SWG, CASB, NGFW, and ZTNA. Its purpose is to integrate secure access into the network architecture, ensuring zero trust access based on identity and context. Sometimes, Forrester refers to it as “Zero Trust Edge” (ZTE).
On the other hand, SSE is a subset of SASE that primarily focuses on securing access to web, cloud services, and private applications. It may also include additional capabilities like Remote Browser Isolation (RBI), Data Loss Prevention (DLP), and Digital Experience Monitoring (DEM).
The key differences between SASE and SSE are in their scope and deployment. SASE covers a broader range of network and security functions, while SSE specifically focuses on security aspects. Your organisation might start with SSE to address immediate security needs and later expand to a full SASE deployment.
So, SSE can work as a stepping stone towards SASE deployment but if you don’t need a full SASE deployment you can use individual SASE components.