Highly mobile, decentralized organizations could implement Secure Access Service Edge (SASE) to provide centralized, cloud based network and security functionality to employees and help simplify security management and governance.

Control Type: Technical

Control Function: Preventive

One of the overarching trends of the 2020s cybersecurity landscape is a move towards mobile, decentralized, and perimeter-less environments. The COVID-19 pandemic pushed organizations towards embracing remote work and cloud services rather than classic on-premises residing behind a secure firewall. Organizations now need to deal with the fact that their digital assets are moving out in the wild west rather than just inside their offices. New cybersecurity solutions aimed at addressing these concerns. One such technology is Secure Access Service Edge (SASE)

SASE is defined by Microsoft as “a cloud-based architecture that unifies wide-area networking (WAN) and network security services into a single, unified platform”. Its key target audience is remote teams and cloud native business environments. SASE combines networking and security functionality into a single unified plane out in the cloud. These services are moved closer to each individual user regardless of where they are. At the same time, security teams can properly scrutinize and validate every activity regardless of its origin point.

Instead of requiring cloud/remote users to use a VPN to remotely connect to the organization’s on-premises infrastructure, the organization can route users through nearby cloud gateways configured with appropriate security policies and restrictions. To better understand how this works, it is necessary to define the five main functions that comprise SASE:

  1. Secure Web Gateway (SWG): organization-defined security measures such as URL filtering, SSL, and application restrictions are applied to user sessions regardless of location.
  2. Firewall as a Service (FaaS): firewall policies and profiles configured and applied through software, often built from templates
  3. Cloud Access Security Broker (CASB): monitors the use of Software as a Service (SaaS) applications and applies features such as DLP and web threat intelligence.
  4. SD-WAN: enterprise network connectivity is configured and managed through cloud software
  5. Zero Trust Network Access (ZTNA): enforces security policies on users accessing organizational data, continuously verifying and inspecting user sessions for threat indicators.

At its core, SASE takes all an organization’s desired network and security functionality and moves it out of on-premises network closets and into the cloud. The SASE becomes the new edge or perimeter of the organization’s network, delivering it to employees through globally dispersed service nodes. This has the added benefit of providing a better, more consistent experience with lower latency to employees. Benefits are also provided to the IT and security staff, as they can centrally manage a decentralized work environment with increased scalability, elasticity, and agility. SASE can integrate with other useful, modern security technologies such as AI/ML based threat detection, privileged access management, and data loss prevention. Migrating to a SASE solution is one of the more complex and challenging security controls outlined in this framework. It is not just a simple piece of hardware or software that is installed to improve security; it is an entire enterprise project that transforms the digital environment. Therefore, careful project management needs to be done, with input from senior management, IT staff, and department heads required throughout.