Service Edge.
Digital business transformation flips network and security service design scheme, switching the focus point to identity of the user and/or device and not to Data Center, as it used to be.
Today’s perimeter is no longer easily defined. The data center was once your network’s primary point of entry and exit, with more users, devices, applications, services and data located outside of an enterprise than inside. The picture below shows how traditional perimeter and edge has moved — today it’s basically a “Dynamic Edge”.
84% of enterprises have a multi cloud strategy and 81% of them point to security as a major cloud challenge. Migration of applications and workloads to the cloud and profusion of endpoints across multiple environments led to expanding attack surface. From 2017 to 2019, there was a 73% increase in the number of organizations experiencing data breaches due to unsecured IoT devices or apps.
Network and network security architectures were designed for an era that is waning. Digital Enterprises are characterized by:
- More user work performed off the enterprise network than on it
- More workloads running in IaaS than in the enterprise data center
- More applications consumed via SaaS than from enterprise infrastructure
- More sensitive data located outside of the enterprise data center in cloud services than inside
- More user traffic destined for public cloud services than to the enterprise data center
- More traffic from branch offices heading to public clouds than to the enterprise data center
Digital business transformation requires anywhere, anytime access to applications and services — many of which are now located in the cloud. This brings CIOs, CISOs and risk managers into a need for converged cloud-native SASE solutions to address this shift.
A SASE solution provides mobile users, branch offices, and retail locations with secure connectivity and consistent security wherever they are in the world. SASE converges the functions of network (SD-WAN, Carrier, CDN) and security services (SWG, CASB, FWaaS, ZTNA) into a unified, global cloud-native service.
Solving emerging business challenges with point solutions leads to technical silos that are complex and costly to own and manage. SASE changes this paradigm through a new networking and security platform that is identity-driven, cloud-native, globally distributed, and securely connects all edges (WAN, cloud, mobile, and IoT).
A SASE architecture enables end-to-end security, whether the source is a remote worker, a branch location, or a headquarters. Threat prevention capabilities include encryption, firewalls, URL filtering, anti-malware, and IPS.
Gartner describes SASE as delivering services and enforcing policies as needed no matter where the entity is located — the result is the dynamic creation of a policy-based, secure access service edge.
A Software-defined Wide Area Network (SD-WAN) is a virtual WAN architecture that allows enterprises to leverage any combination of transport services — including MPLS, LTE and broadband — to securely connect users to applications. The SD-WAN solution can intelligently identify applications and determine the best path to maximize functionality.
SASE combines an SD-WAN approach and security functionalities into one cloud-based service. An element of SASE that sets it apart from SD-WAN is how it inspects traffic — instead of using service-chained point solutions, SASE runs all security functions at once in multiple policy engines that make up a cloud-native software stack.
In a digital business, secure access decisions must be centered on the identity of the entity at the source of the connection. Other relevant sources include location, time of day, risk/trust assessment of the device, and the sensitivity of the application or data being accessed.
Instead of the security perimeter being entombed in a box at the data center edge, the perimeter is now everywhere an enterprise needs it to be — a dynamically created policy-based secure access service edge.
There are many benefits of SASE, but the most impactful is that it allows users to immediately gain secure access to a company’s network, wherever they are and whatever device they use.