Secure Access Service Edge (SASE)

For a long time, the “edge” of the corporate network was a PC that connected directly to a port in an office. As laptops overtook desktops, staff had increased mobility and started working from cafés near a client office, on trains or in airports while waiting for a flight. 2020 saw a huge segment of the workforce having to operate from home.

Essentially, wherever the nearest point of Internet connectivity for the user was became the new corporate network “edge”. However, this situation provided none of the cyber security an office could offer, none of the network control, and no visibility at all into which applications or cloud services were being used.

The result?

A significant lack of control and visibility into user activity and protection. Companies tried to mitigate the situation by deploying small “take home” firewalls or bolstering VPN connectivity back into the office, but these became too expensive or incredibly time consuming to manage and a single point of failure.

SASE (Secure Access Service Edge) is a software solution that securely connects a mobile device to a cloud-based private network, authenticates the user, and dictates specifically which application services they can use.

All firewalling and intrusion detection capabilities are managed in the SASE cloud network, so there is no need to enhance those devices at physical locations. The solution provides full control, visibility and protection of user application access, regardless of where they are connecting from.

Have you had to begin supporting a remote workforce because of Covid? Do you have to regularly manage access to corporate and SAAS applications for contractors? Have you struggled to implement the extra communications infrastructure required to meet capacity? Are you spending a disproportionate amount of time managing remote user connectivity and changes? Then, yes, SASE solutions could transform your business.

A SASE solution helps you manage user to application connectivity in a secure, agile way so the “business intent” of, for example, allowing a finance department member access to finance applications is configured by username and app name, not by low-level IP addresses, so you can keep up with the rate of change demanded by the business.

SASE also helps you keep on top of compliance by enforcing application access standards and providing easy auditability as evidence. Start your journey to zero-trust network with a SASE consultation.

A a single network that connects and secures any enterprise resource – physical, cloud, and mobile – anywhere and has the four main characteristics 

• Identity-driven.  User and resource identity, not simply an IP address, determine the networking experience and level of access rights. Quality of service, route selection, applying risk-driven security controls — all are driven by the identity associated with every network connection. This approach reduces operational overhead by letting companies develop one set of networking and security policies for users regardless of device or location.

• Cloud-native Architecture. The SASE architecture leverages key cloud capabilities including elasticity, adaptability, self-healing, and self-maintenance to provide a platform that amortizes costs across customers for maximum efficiencies, easily adapts to emerging business requirements, and be available anywhere.

• Supports All Edges. SASE creates one network for all company resources — datacenters, branch offices, cloud resources, and mobile users. For example, SD-WAN appliances support physical edges while mobile clients and clientless browser access connect users on the go.

• Globally Distributed. To ensure the full networking and security capabilities are available everywhere and deliver the best possible experience to all edges, the SASE cloud must be globally distributed and deliver a low latency experience. 

SASE extends your corporate network to the cloud, so as far as any user is concerned, the access “edge” now becomes any Internet gateway.

Ordinarily, a SASE agent would be installed on an end user’s laptop which, upon connection with the internet, immediately establishes a secure link to a corporate cloud hub. The hub will then authenticate the user either directly or via identity sources such as Active Directory or Okta.

Centrally-controlled policies then map the user ID to the allowed applications (SAAS or on-premise) and only let through requests for authorised services. This approach leads towards the ability to implement Zero Trust Networking which is a key Cyber Security initiative.

Depending on the vendor, additional features can be optionally added to the SASE cloud hub such as in-cloud next generation firewalling and intrusion protection, end-user experience monitoring, and patch management.

SASE provides centralised management of your distributed workforce, giving you the confidence that they are connecting securely to the applications they are authorised for, wherever they are and however they are reaching the Internet.