When you combine these halves in a whole, you have SASE: a unified platform designed to connect and protect its users.
Traditionally, networking and security have been siloed. Security is perimeter-based, with defenses at a fixed point facing outward—assuming that anyone inside is a trusted user. A wide area network (WAN) moves traffic between branches and data centers, while firewalls, gateways, and access controls establish security measures.
This made perfect sense when users and their critical applications were on-location at a corporate office, store, or other official facility. But today, workforces are distributed to one degree or another, many if not most core applications are in the cloud, and data moves in floods between the edge and centralized data centers.
This is where Secure Access Service Edge (SASE) comes into play. SASE is a cloud-delivered service that combines networking and security. With teams dedicated to SD-WAN and cybersecurity, we find that SASE is a great solution for organizations in a variety of situations. From multi-branch organizations juggling remote workforces to companies looking to streamline networking and security, SASE maximizes both connectivity and protection. In this post, we’ll explore what SASE is and the benefits it offers, so you can make an informed decision if it could be the solution for you.
Think of SASE as two halves: networking and security. The networking half is software-defined wide area network (SD-WAN). SD-WAN provides the core capabilities of WAN—linking branches, data centers, and other remote sites—but does so through software. SD-WAN can be implemented “over-the-top” of any network, such as broadband, MPLS, or LTE, and routes traffic intelligently based on the application.
The other half is security, called Security Service Edge (SSE). SSE provides four core functions. A secure web gateway (SWG) filters traffic and enforces policies. A cloud access security broker (CASB) enforces user policies between users and cloud applications. Firewall-as-a-service (FWaaS) operates from the cloud across the network, as opposed to local machines. And zero trust network access (ZTNA) applies the “never trust, always verify” principle of Zero Trust Architecture to application access.
When you combine these halves in a whole, you have SASE: a unified platform designed to connect and protect its users.
When networking and security operate in separate silos, protection is at the perimeter and anyone inside is assumed to be trustworthy. That model makes sense when your users, applications, and critical data are inside a building working on a local server.
Today, many employees, applications, and associated data are simply not in the same location. If the traditional approach to networking and security is being used, this traffic must be routed back to the private data center for screening before it goes to the cloud. In addition to a wider attack surface, this backhauling adds latency and degrades performance.
With SASE, traffic is not backhauled to a central chokepoint before reaching the user or application. Instead, networking and security are distributed across the cloud wherever the user is located. By removing that extraneous step, network traffic flows far more efficiently. Security becomes more robust because it’s based on identity, not network position. The result is a unified cloud-delivered platform that streamlines network infrastructure, boosts performance, and hardens security—even for distributed teams that rely heavily on cloud applications.
Reduced IT burden and cost: By replacing several major parts of an organization’s tech stack with one platform, IT teams spend less time stitching point solutions together that need to be maintained in perpetuity.
A recent analysis found that SASE reduced ongoing network-security operating costs by ~40%.[1]
Hardened security overall: With networking and security under unified policies, equal protection extends to every user, regardless of location. This closes gaps that cybercriminals can exploit. ZTNA establishes continuous identity verification for every access request, reducing the potential attack surface and restricting lateral movement across the network.
Superior protection for remote workers: SASE was designed for remote and mobile employees, enabling them to connect directly and securely to whatever application they need, wherever they are, without relying on VPNs or other point solutions.
Improved performance: As traffic no longer needs to be backhauled to a central data center for security analysis, latency is reduced, resiliency and uptime are enhanced, and the user experience becomes more consistent.
If you’re running a traditional networking and security model but want a streamlined platform that offers benefits in security, cost, and performance, SASE may be the solution for you. Here are a few questions that can help you narrow down your options.
Make sure you know what you’re getting: Some SASE products are actually separate solutions that are packaged together, rather than a unified SASE platform. While a particular bundle may be the best option for a specific organization’s needs, a true SASE platform unites SD-WAN and security with a shared architecture and policy engine.
Confirm points of presence (PoP): PoPs are locations where a SASE provider has the physical infrastructure to route and inspect traffic. If a PoP footprint doesn’t align with locations where your offices and employees are, overall performance may suffer.
Insist on ZTNA as a foundation: Not all SASE platforms are built on a zero-trust-first architecture; some bolt ZTNA onto a legacy firewall or VPN. Ensure that ZTNA is foundational to the product, not a bolted-on feature.
Evaluate your internal resources for networking and security: As SASE combines both elements, having experts in both disciplines involved in SASE platform selection and deployment is critical for success. If you’re lacking in either of these departments, consider bringing in an outside partner.
SASE is a genuine evolution in networking and security that offers benefits to performance, security, and costs, particularly for organizations with remote workers who rely on cloud applications. However, selecting the optimal platform and implementing it is a complex endeavor, particularly for organizations that do not have robust networking and security teams.
If you’re interested in SASE, we have teams dedicated to connectivity and cybersecurity. We can help you select the right platform, map it according to your organization’s operations, and roll it out without disruption. If you have any questions or would like to get started, reach out to us today.
[1] https://www.mordorintelligence.com/industry-reports/global-secure-access-service-edge-market