31st October, 2021
7 Min read
Book a Demo
In a world of quickly-expanding cloud traffic, SASE has emerged as the clear choice for ensuring a proactive security posture and consistent protection against emerging cloud-native threats. SASE also gains popularity for converging security and speed – a potent combination which helps realize the potential of the cloud.
Read more in our guide “How to Guide: Zero Trust Transformation“.
Reduce your AWS costs by over 50%
Discover your Cloud Saving Potential – Answer just 5 simple questions. AppsFlyer, Playtika, Lufthansa, IBM, top leading companies are already using our FinOps services.
What is Secure Access Service Edge (SASE)?
SASE is a complete solution that combines SD-WAN capabilities with network security functions such as Cloud Access Security Broker (CASB), Firewall Access as a Service (FWaaS), Secure Web Gateway (SWG) and Zero Trust Access Network (ZTNA). Download the eBook to learn more about the
Pros and Cons of SASE
- Easier to configure and manage than the most popular option, VPNs
- Relatively easier to scale and deploy
- Less expensive than traditional solutions
Cons
- SASE requires expert skill sets to configure and exhaust its various capabilities to the fullest.
- SASE is still an emerging technology – this affects both the stability of some existing features. But more importantly, it can be misused by vendors as a buzzword that does not really correspond with the true nature of their offering.
What is Zero Trust?
The Zero Trust model challenges the basic assumption of security by assuming that everyone on the network – be it a device or a human being – is a potential attacker. Hence every action has to be verified for every session. As this model automatically assumes that there is no trust, every entity has to authenticate and prove its credentials for every session
Pros and Cons of Zero Trust
Pros
- Clear segmentation of data allows sensitive data to be protected in a better way
- Proactive security posture as basic assumption is that everything is under attack and has to be monitored actively
- Multi-layered protection ensures better security
Cons
- Implementing a Zero Trust model requires the help of an expert
- Increased monitoring and management of activities of people, applications and devices
SASE vs Zero Trust
Zero Trust is an approach for reducing or eliminating security risks by trusting no entity – (known or unknown) for any access, while SASE is a holistic security solution designed to protect enterprises proactively. SASE is like a solution that specifically tells enterprises on how they should go about deploying specific networking and security technologies, Zero Trust is more like a process that focuses on continuous monitoring and elimination of threats as a result of deploying multiple technologies that have their own strengths.
Put simply, Zero Trust is more like a strategy, while SASE is a solution that can be deployed to ensure success of a Zero Trust strategy.
| Zero Trust | SASE |
| An approach for eliminating risks by assuming a zero trust approach | SASE is a framework or a solution that specifically calls upon how certain technologies can be combined into a single cloud-based service to ensure a robust security posture |
| Zero Trust works on the principles of least privileged access and every transaction has to be authenticated again or verified again, even for proven identities | SASE details out on how networking and security services must be deployed. This includes network services, network security services, identity and delivery using cloud |
Is SASE the same as zero trust?
SASE is not the same as Zero Trust. SASE may be used for ensuring or fulfilling an organization’s journey towards implementing a zero trust model. The Zero Trust model is based on a core set of principles that is ensured by a SASE model. For example, in a SASE model, all network traffic is authenticated and verified, and every access is decided by a dynamic policy. Similarly, every transaction or communication needs encryption and authentication. All these factors are fundamental to the Zero Trust model. Hence, SASE is an enabler towards fulfilling a Zero Trust model.
Is Zero Trust part of SASE?
As Zero Trust is relatively new terminology, it is common to see Zero Trust, ZTNA and ZTA used interchangeably. Let us understand each term. Zero Trust is an approach where no trust is assumed. Trust has to be established for every transaction using multiple mechanisms involving identity and context. In a Zero Trust model, access is always given based on the least privileges principle.
Zero Trust Access (ZTA) allows CISOs to understand and have knowledge of who is on the network and restrict access points. This helps in reducing points of vulnerabilities so that only legitimate users have access and that too to their area of work.
Zero Trust Network Access (ZTNA) is one of the elements of ZTA, which enables access to applications or resources irrespective of where the user is based.
Zero Trust Access Network is part of the Zero Trust model. ZTNA is a software-based security solution that enables secure remote access based on access control policies. By integrating ZTNA, a SASE solution makes the deployment of the Zero Trust model possible. For example, a SASE solution can filter out malicious content by inspecting traffic in a detailed way.
Can Zero Trust and SASE work together?
By combining SASE and a Zero Trust model, an enterprise can centralize the entire portfolio of security tools and have fewer management and streamlining issues. This also considerably improves the security posture, as there are no visible gaps between security tools, and enterprises can have a single view of their ecosystem that includes networks, applications and databases.
In summary, SASE converges network and security in a way that delivers 6 of the 7 components of the zero trust architecture (all except cloud WAF). Let us see how SASE makes this possible:
Application-Only Access, Not Network Access: SASE can grant user access to only the specific applications that are needed with respect to their roles and privileges. This can be further refined based on factors such as user identity, device posture, authentication and authorization. This restricts lateral movement within the network and reduces unfettered network access.
Puts Identity, Authentication, and Authorization in Place: Enterprises must isolate application and access architecture from the public Internet so it cannot be targeted by malicious actors using open listening ports. SASE puts in place identity, authentication and authorization layers in place, to ensure that only users with adequate credentials can gain access.
Multifactor authentication (MFA) provides an extra level of verification and security: SASE ensures that the user is authenticated and authorized through MFA, single sign-on (SSO) enables users to log in to all applications with one set of credentials. This improves productivity; there’s no need to reconfirm identity for each application and no syncing issues across applications.
Domain Name System (DNS) Layer Security provides proactive defense: DNS is a neglected vector. It has been observed several times that cybercriminals have developed malware that is specifically tailored to exploit this security gap, evading existing security layers to infiltrate the network and exfiltrate data. SASE adds a layer of security that leverages the DNS protocol. By utilizing DNS as a security control point, a SASE solution can detect and stop cyberattacks early in the kill chain, proactively protecting the enterprise.
Complete visibility into network activities: SASE enables enterprises to monitor and verify all DNS requests from devices both on and off the corporate network — whether originating from laptops, mobile phones, desktops, tablets, guest Wi-Fi, or IoT devices — to ensure that queries are not headed for malicious or unacceptable sites. SASE also gives organizations the capability to examine traffic behavior for signs of suspicious activities, such as communication with a command and control server or data exfiltration — and alert IT immediately of any issues. In this way, SASE ensures that the core tenet of Zero Trust is fulfilled. SASE allows businesses to have visibility into what is happening on their networks, with ample traffic and intelligence to make relevant comparisons.
Seamless integration with third-party solutions: Enterprises may have hundreds, or even thousands, of applications. These require configuration via API to rapidly deploy applications in bulk while also setting policy controls for access. This is critical functionality for any large-scale application environment seeking to rapidly migrate from traditional VPN access to application specific access. Adoption of APIs continues to increase as enterprises embrace DevSecOps and look for monitoring and configuration tasks available via RESTful API. SASE ensures that enterprises can incorporate threat and event data into SIEM for further investigation and correlation. SASE also integrates with workflow automation platforms and threat remediation by signaling into third-party endpoint detection and response solutions.
This makes it a holistic solution, in line with GlobalDots’ holistic approach: We want to have the lowest possible number of products and dashboards, answering as many of the organization’s performance and security needs as possible. SASE is therefore the smartest way to speed up your Zero Trust journey. SASE is also cloud-native and scalable, in line with our efforts to make organizational infrastructures lean, cost-effective and always up-to-date with no IT effort.
With over 17 years of experience, GlobalDots has an unparalleled knowledge of core technologies. With our expertise in SD-WANs and SASE, and our deep understanding of multi-cloud environments, we can help in replacing the current SD-WAN or MPLS within a single day. This can be configured to cost less and perform far better than legacy networks.
Contact us today to consult our experts and get a personalized demo.