Blog
What is SASE (Secure Access Service Edge)?

What is SASE (Secure Access Service Edge)?

Catherine Chipeta
Catherine Chipeta
updated Nov 11, 2021

SASE (Secure Access Service Edge) is a network architecture that unifies network and security solutions into a cloud-based service to enhance accessibility, efficiency, and cybersecurity

The concept of SASE was introduced in Gartner's 2019 report 'The Future of Network Security Is in the Cloud'. The concept emerged from organizations' increasing demand for reliable access across transforming network approaches.

Gartner published a follow-up white paper ‘2021 Strategic Roadmap for SASE Convergence' with a migration plan for organizations shifting from legacy network infrastructure to SASE. 

How Does SASE Work?

Traditionally, an organization's network traffic predominately flowed throughout its different locations, such as branch offices, with most security architecture and applications hosted at data centers or its headquarters and remotely accessed through a Virtual Private Network (VPN). 

Digital transformation has disrupted traditional networks. Modern networks are considerably more complex, often comprising SaaS products, cloud technology, Internet of Things (IoT) devices, mobile devices, and remote workers. 

These endpoints all require network security and connectivity. The large amount of traffic they generate to and from data centers paired with the security inspection process causes latency and diminished user experience (UX). 

SASE aims to address these inefficiencies by allowing organizations to scale their networking and security capabilities directly across all endpoints at any location through its cloud delivery model. 

The SASE Security Model

The SASE framework works through several technologies which allow necessary network and security functions to be deployed directly from the cloud in unison. 

Gartner states that SASE works by 'combining comprehensive WAN capabilities with comprehensive network security functions … to support the dynamic secure access needs of digital enterprises'.

The SASE security model enables these technologies to work together seamlessly across the network to move away from siloed security stacks, where organizations must implement independent security solutions, policies, and systems.

Gartner outlines the following network and security capabilities as core components of the SASE security model:

Software-defined Wide Area Network (SD-WAN)

A traditional wide area network (WAN) routes all remote traffic through a data center firewall, resulting in latency and bottlenecks, which impede the performance of the network and applications.

SASE uses software-defined wide area network (SD-WAN), a cloud-based service that efficiently routes traffic across the WAN via strategically placed points-of-presence (PoPs). PoPs are distributed across the SASE network near devices, branch offices, and data centers. They directly route user traffic to the cloud and SaaS services to improve network speed, security, and performance. 

Through SASE, organizations can add network security features onto the SD-WAN's functionality to avoid implementing them separately at each branch/data center on the network edge, saving significant time and costs.

Firewall-as a-service (FWaaS)

Firewall-as-a-service (FWaaS) can operate on-premises but is often leveraged through the cloud in a SASE configuration. FWaaS offers the same solutions as a stateful firewall - network monitoring, packet filtering, and IP mapping - with additional next-generation firewall (NGFW) capabilities.

NGFW features include:

Cloud Access Security Broker (CASB)

Cloud access security brokers (CASBs) are vital in enforcing security policies across an organization's SaaS applications. CASBs use authentication and authorization through standards like SAML to allow employees to access both internal and SaaS apps through the same portal, eliminating the need to route traffic externally from the SASE network.

CASBs also provide the following functionalities:

Secure Web Gateway (SWG)

As employees often need access to resources beyond the network edge, this increases the attack surface can make it difficult to manage compliance. A secure web gateway (SWG) protects organizations from cybersecurity threats like phishing attacks, botnets, and malware. 

SWGs can also perform the following security functions:

  • Inspect web traffic and filter inappropriate content
  • Implement security policies
  • Prevent corporate data leakage
  • Block unauthorized users from gaining access

Zero-trust Network Access (ZTNA)

The zero-trust network access (ZTNA) information security model assumes no trust from all users, whether inside or outside the network edge. Users must verify or authenticate themselves before accessing any sensitive data.

ZTNA provides organizations with visibility and access control of all users, devices, and applications through the least privilege principle. This principle only grants access to required applications/services to limit the attack surface should an unauthorized user compromise an employee's account. 

ZTNA usually relies on multi-factor authentication (MFA) or two-factor authentication to verify users' identities each time they request access to any network resources and cloud services.

The ZTNA model can also rely on the following technologies to provide network security:

Gartner SASE Predictions

Gartner has detailed its expectations about organizations' adoption and effectiveness of SASE in the future. 

Some key predictions include:

  • By 2023, to deliver flexible, cost-effective scalable bandwidth, 30% of enterprise locations will have only internet WAN connectivity.
  • By 2023, 20% of enterprises will have adopted SWG, CASB, ZTNA, and branch FWaaS capabilities from the same vendor.
  • By 2024, 30% of enterprises will adopt cloud-delivered SWG, CASB, ZTNA, and branch office firewall as a service (FWaaS) capabilities from the same vendor.
  • By 2024, at least 40% of enterprises will have explicit strategies to adopt SASE.
  • By 2025, at least 60% of enterprises will have explicit strategies and timelines for SASE adoption encompassing user, branch, and edge computing access.

Sources: The Future of Network Security Is in the Cloud, 2021 Strategic Roadmap for SASE Convergence

SASE Benefits

Lower Costs

SASE consolidates functions that organizations would typically need several service providers to manage and requires fewer on-premises hardware components than traditional networks. These factors significantly reduce organizations' existing network and security overheads.

Management Efficiencies

As the SASE model operates as a centralized service, IT teams can manage all applications from one access point rather than managing individual network devices across several locations. 

The cloud-based nature of SASE also enables organizations to scale the architecture's application as quickly as the network grows.

Enhanced Network Security

SASE services enhance network security through their in-depth approach to network protection. An ideal SASE service can help detect and prevent cyber attacks like Distributed Denial-of-Service (DDoS) attacks, man-in-the-middle attacks, phishing, email spoofing, and different types of malware through in-depth security inspections. 

ZTNA is a core component of SASE, ensuring all users and devices are granted authentication and authorization before accessing any network resources. Reputable SASE providers also offer encrypted connections and strict policy controls.

Network Performance Optimization

SASE architecture is designed to accommodate modern working models, providing faster, more reliable network connections to all endpoints, including mobile users and remote users. Cloud-native apps and SaaS services run on low-latency connections as access is facilitated through a unified platform. 

As SASE platforms offer all network and security functions in a single service, they are much easier to monitor and maintain than legacy systems. Security teams are afforded visibility over all incoming and outgoing traffic from a single interface.

The global distribution of PoPs means these capabilities extend to areas of the remote workforce that were once more difficult to incorporate into the network. 

SASE Challenges

Operational Roadblocks

As SASE requires the usually separate network management and security teams to work together, they need to on strategies, priorities, and objectives during its deployment and ongoing development. 

If both departments struggle to agree across these areas, there could be delays and other operational roadblocks surrounding SASE implementation.

Unique SASE Offerings

SASE combines a package of services that organizations traditionally obtain from several different third-party vendors. As SASE is an adaptable framework, there is no one-size-fits-all solution available to organizations. 

Organizations will likely need to shop between different SASE solutions to find suitable offerings to tie into their specific workloads and use cases. 

Unknown Needs

Considering SASE's infancy, organizations may not know which combination of services they need to match their organization's specific needs. They may need to rely on trial and error across SASE vendors, which is resource and cost-intensive.

Increased Third-Party Risk

SASE implementation requires a number of technologies that organizations will likely source from several vendors. Not only do these technologies heighten cybersecurity risk, but each of these vendors carries third-party risks, which further extend to fourth-party risks. Organizations much account for these additional attack vectors through effective information security policies and vendor risk management strategies

Top SASE Vendors

The following vendors can help organizations adopt the SASE model.

1. Akamai

Akamai's cloud architecture offers secure access to cloud applications and other third-party apps, delivered through a global Content Delivery Network (CDN).

Features:

  • SWG
  • DLP
  • ZTNA
  • MFA

2. Barracuda Networks

Barracuda's platform offers users secure access to SaaS apps and on-device security for internal apps through proxy servers

Features:

  • SD-WAN
  • FWaaS
  • IPS
  • ATP
  • ZTNA
  • Malware scanning
  • Content filtering

3. Cato Networks

Cato's cloud infrastructure delivers SD-WAN and SASE services through a global network of PoPs. 

Features:

  • NGFW
  • SGW
  • ZTNA
  • ATP
  • Cloud
  • Mobile security

4. Cisco

Cisco's cloud-native platform offers complete network and security functionalities in a comprehensive SASE solution.

Features:

  • SD-WAN
  • SWG
  • CASB
  • NGFW
  • ZTNA

5. Cloudflare

Cloudflare offers a security stack through a global CDN that can be paired with an existing SD-WAN.

Features:

  • CASB
  • ZTNA
  • Web filtering
  • VPN

6. Fortinet

Fortinet's SASE stack includes cloud-based security functionalities across a distributed network.

Features:

  • SWG
  • DLP
  • ZTNA
  • VPN
  • IPS
  • FWaaS

7. Netskope

Netskope's cloud-native security functionality provides real-time protection at the network edge.

Features:

  • NextGen SWG
  • ZTNA
  • CASB
  • Public cloud security

8. Palo Alto Networks

Palo Alto provides in-depth cloud-delivered security offerings to offer complete network protection.

Features:

  • SWG
  • ZTNA
  • CASB
  • FWaaS
  • VPN

9. VMware

VMware's cloud-native architecture combines networking and security services for delivery across an expansive multi-cloud network.

Features:

  • SD-WAN
  • SWG
  • CASB
  • ZTNA
  • FWaaS

10. Zscaler

Zscaler's cloud security platform delivers globally distributed services for sure access to apps and data.

  • CASB
  • ZTNA
  • IPS
  • DNS Security
  • Browser proxy
  • Cloud Sandbox
Free

UpGuard logo in white
UpGuard free resources available for download
Learn more

Download our free ebooks and whitepapers

Insights on cybersecurity and vendor risk management.
UpGuard logo in white
eBooks, Reports & Whitepapers
UpGuard free resources available for download
UpGuard customer support teamUpGuard customer support teamUpGuard customer support team

See UpGuard In Action

Book a free, personalized onboarding call with one of our cybersecurity experts.
Abstract shapeAbstract shape

Related posts

Learn more about the latest issues in cybersecurity.
Deliver icon

Sign up to our newsletter

Get the latest curated cybersecurity news, breaches, events and updates in your inbox every week.
Abstract shapeAbstract shape
Free instant security score

How secure is your organization?

Request a free cybersecurity report to discover key risks on your website, email, network, and brand.
  • Check icon
    Instant insights you can act on immediately
  • Check icon
    Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities
Website Security scan resultsWebsite Security scan ratingAbstract shape