Taking First Steps Toward a SASE Architecture
Article by Surendra Singh, Senior Director & Country Manager (India), Forcepoint
The events of 2020 saw organizational structures undergoing a 360-degree change. By default, people now work remotely and require secure remote access to the network and their apps. This is totally opposite to working within the secured premises of an organization where remote security was provided to only a few on a need basis. Instead, it’s the other way round. As organizations were forced to shift to cloud in a very short period of time to provide remote access to their people, IT teams had to find new ways of securing their networks and remote users.
The solution couldn’t be based on-premise, that’s why the SASE architecture, first proposed by Gartner into its own.
In 2019, analyst firm Gartner formulated a new architecture model for security and networking. It was called SASE, short for Secure Access Service Edge. This model proposed to combine security and networking functions in a holistic, cloud-native service and replace the classic IT security architectures of companies that secured their networks externally with on-premises tools.
This approach is the answer to central developments in digital transformation. More and more companies are moving applications and data to the cloud, and an increasing number of users are accessing them from outside the corporate network. These include remote employees, for example in the home office, mobile employees on the road, but also employees in branch offices and subsidiaries without their own data centers.
Traditional network and security architectures force the flow of data to pass through the central data center, as this is the only way to ensure that it is protected by the security measures there. The consequences are weak performance, high latency and resulting connection failures. In order to avoid this, many companies now connect their mobile and remote employees and their branch offices directly to the Internet and cloud applications. They use technologies such as SD-WAN, but are forced to bypass the centralized on-premises security gateways.
Bringing Networking and Security to Where Apps and Data Reside
The SASE concept addresses these challenges by bringing networking and IT security into the cloud – and thus directly to where the applications and data reside. Many vendors have therefore already begun to develop products and solutions to support SASE architectures. Their task will be to combine all the necessary security and connectivity technologies and make them available as a holistic cloud service; from Secure Web Gateway, Firewall as a Service, Cloud Access Security Broker or Data Loss Prevention/Data Leakage Prevention to SD-WAN.
The SASE architecture not only enables companies to connect their users and branch offices around the world directly to the cloud through a single security layer, but also to increase performance. They can also implement their connections more easily and cost-effectively. Security and IT managers also get a unique opportunity to reduce the complexity of their environments and benefit from simplified network and security management through a centralized management hub.
While the SASE Market Evolves, Prepare
The SASE market is still in its early stages. It will take some time until complete SASE portfolios are available. But there is no question that this concept will be fully embraced in future. In fact, the challenges it addresses we already face today. For these reasons, companies should start now to take the first important steps towards SASE architecture such as:
- Look at the people and data at the heart of the cloud security designs: Who needs to connect to which applications, where are they located and how do they connect to them? Secure SD-WAN technologies can optimize network performance and costs for users in the branch offices. Redirections to the central data center via private connections such as VPNs are thus relieved. In many cases, integrated cloud security services can not only ensure security, but also increase transparency.
- Consider the possibilities of cloud web security for mobile and remote employees. Web security can protect employees from malware embedded in websites, download files or links, regardless of where they connect to the Internet.
- Gain visibility and control over the organization’s cloud applications and data. The organization should know how their users connect. Do they use proprietary or BYOD terminals? Cloud Application Security Brokers can control access to business-critical applications and enforce corporate data security policies for the information stored there. This makes it easier to secure the use of cloud applications on both managed and unmanaged endpoints.
- Begin to migrate the security stack to the cloud using integrated cloud web security, cloud application security brokers and cloud-based data loss prevention/data leakage prevention. The integrated approach helps organizations regain control of their most critical data-no matter where users access and interact with it.
Be Smart While Choosing Your SASE Partner
The IT partner with whom companies take these steps is, of course, ideally also the provider for their complete SASE architecture. Therefore, they should be selected with special care. Companies must be careful with technology and service providers who already market supposed SASE complete solutions. Such offers are usually only based on the bundling of already existing technologies or a combination of products in service chains. These approaches do not correspond to the holistic SASE model, but, in contrast, lead to inconsistencies, weak structures and additional latency.
The SASE concept is the future of networking and IT security. Even if it will still take a few years until complete solutions are available: companies can already take the first steps towards the SASE architecture and secure their organization’s future.
