SASE: The new king of security consolidation

Originally coined by Gartner in a 2019 report, secure access service edge (SASE) is one of the fastest-growing buzzwords among vendors, customers and analysts alike as it provides a revolutionary solution to the growing onslaught of cyber threats.

Enterprises currently face a number of challenges when migrating to the cloud, including performance, latency, data movement, control and visibility among others. While they are rightfully concerned about these challenges, existing cloud security vendors don’t materially improve the security efficacy in any way. The detection-based legacy security stack has simply found a new home in the cloud.

At a high level, enterprises have three simple problems they are trying to solve: Provide a malware-free internet experience to employees; perfect control and visibility for sanctioned and unsanctioned applications; and, lastly, deploy a zero-trust way of accessing private applications without the clunkiness of VPN infrastructure. SASE provides for an architecture in the cloud that makes this possible, and the underpinning in all these use cases is better security.

With SASE, the benefits from necessary network security layers -- such as data loss prevention (DLP), cloud access security brokers (CASBs) and secure web gateways (SWGs) -- are all consolidated into the cloud itself. With numerous aspects of security placed in a one-stop shop, everything an organization needs is located in a consistent, cohesive and integrated platform. Customers aren’t required to become acquainted with different integrations and formats for every solution. This drives down the total cost of ownership and provides an enormous return on investment.

Barriers to entry: UX, cost and scale

Isolation is rapidly becoming a requirement to deliver on the promise of SASE, but cloud security vendors must overcome significant challenges to deliver unmetered isolation at scale across the three use cases:

1. User experience – The tradeoff between security and UX has been an ongoing challenge, but it has become more pronounced with the shift to remote work. When deciding between security products or services, if users don’t perceive a recognizable improvement between what they’re currently using and a potential replacement, there’s no incentive to change and most will avoid it altogether.
2. Cost – Especially in the era of COVID-19, agencies have tighter budgets and must reevaluate their security strengths, weaknesses, opportunities and threats. The biggest challenge for many is cost. If a security vendor offers the best solution in the world, but is 10 times more expensive than the next best competitor option, it doesn’t stand a chance with most agencies.
3. Scale – In order to deliver valuable security, a solution must address multiple issues across a wide user base. In the past, it’s been possible for organizations to just rely on security layers such as isolation or proxies for a limited set of users, but the future will require the full stack, including these and others such as CASB and DLP, in order to efficiently provide proper security for a much larger user base.

Federal government leading the pack

Even though SASE is applicable for all industries, it has already demonstrated its impressive potential within a few verticals. Industries that deal with highly sensitive data or that were required to make rapid changes due to the shift to remote work, such as financial services, health care and government, have been some of the early SASE adopters.

One federal agency needed to overhaul its entire security infrastructure. Modernizing the existing appliance-based architecture was cost prohibitive and would not address current threats, so officials ultimately decided to shift to the cloud. Following a competitive and lengthy bidding and trial process, the agency awarded a contract for its new approach to secure remote work. This re-architected security infrastructure provides secure internet access for several million users across the globe. Due to the sheer scale of the project and volume of users, this deployment will become the largest Secure Web Gateway and ultimately SASE deployment, in the world.

Even in early stages of implementation, there have been dramatically improved results. For example, the agency witnessed a 70% reduction in the files that are coming down to the endpoint and a 40% reduction for services requiring larger bandwidth. By rerouting its non-mission-essential web browsing traffic, it has reduced the stress on the VPN infrastructure from a peak utilization of 94% down to roughly 50%. These positive results are just the beginning of the evidence of the business impact from a modernized security architecture.

In the rapidly changing security industry, technology buzzwords and promising innovations often take on a life of their own, leading to widespread misconceptions around emerging trends. However, by emphasizing security and understanding how an isolation core can place an uppercase S in SASE, agencies of all kinds can maximize ROI and exponentially enhance their security posture.