SASE: what it is, and why you need to care
The big changes that have swept workplaces in recent years have brought both opportunities and challenges for management and staff.
Armed with an increasing array of mobile devices and given access to cloud-based resources, many workers are now able to operate from almost any location. Across an organisation, resources can be readily scaled to meet demand and ensure new opportunities are grasped as soon as they appear.
While this new, more flexible way of working has been widely embraced, it's raised some red flags when it comes to IT security. Systems, applications and data are no longer simply stored in an on-premises IT infrastructure that can be ring-fenced for protection. The combination of mobile working and cloud has radically changed security requirements.
A new approach
One approach that is gaining growing attention is Secure Access Service Edge (SASE), named by Gartner, is designed from the ground up with the digital workplace and remote workforce in mind. Gartner so strongly believes in the future of SASE that leading analysts wrote a paper about SASE called, "The Future of Network Security is in the Cloud.
At its heart, SASE ensures data traffic is fully secure throughout its journey, between a device and a destination application, regardless of where a user is located or the type of device they are using. It's this focus on the secure journey, rather than the destination, that is critical.
While this concept will sound very appealing for many CIOs and security managers, its adoption has to be carefully planned and executed. Also, for early adopters keen to get started, there is limited practical information to help guide those carrying out the work.
One of the most significant errors an IT team can make when implementing a SASE strategy is to think that they can simply apply existing security controls to a cloud platform. Taking this approach will isolate users within a single ecosystem, which is effectively no different from a traditional hub-and-spoke network.
Another mistake that occurs is when a security team regards SASE as a single service, rather than something that comprises a range of different ones. These include items such as SD-WAN, zero trust network access, and DNS protection.
Some security teams also strike issues because they fail to fully understand the meaning of the word 'edge' within the SASE strategy. Rather than being the traditional edge of a network, the term actually refers to the journeys that data is taking across an organisation.
Implementing a SASE strategy
Once a decision has been made to institute a SASE strategy, there are four key steps that need to take place. Covering these will ensure that the protection required for data can be put in place throughout its journeys.
The four critical steps are:
- Assess your infrastructure: An important initial step is to identify and assess every potential user and source of data across your entire IT infrastructure. It's vital to fully understand which users need to access which applications and data stores and how they are going about it.
- Evaluate destinations: A second step is to gain a full understanding of exactly where all users are actually going and what they are accessing. Both source and the end-destination should be understood from the outset of any interaction, allowing all data to be secured throughout its journey.
- Establish effective policies: Thirdly, focus needs to be placed on the security controls and policies that are required to make a SASE strategy work. Do you want to allow your employees to view Netflix, for example? It is only when source, destination, and access controls are unified that data can be secured throughout its journey. In addition to these controls, understanding context is also needed to enable informed decisions to be made based on source and destination.
- Explain the benefits: Once the SASE strategy is in place, take time to explain the benefits that it provides to staff. Essentially, it will assist them in securely accessing the data and applications they need to support their day-to-day activity. Improved security means a more effective and productive workplace.
Once these core steps have been completed, rollout of the new SASE strategy can take place. However, rather than trying to put it in place across an entire organisation from the outset, it is far better to select a small subset of applications or users and conduct testing. In this way, SASE can be road tested and assurances can be established that it is delivering the levels of security required.
New, modern workplaces require a new approach to IT security. By embracing SASE and putting it to work, organisations can be confident they are well placed to meet the challenges of the future.
