NC Nov-Dec 2021

FEATURE: SASE
SECURING A DISTRIBUTED WORKFORCE
WITH SASE
DANIEL BLACKWELL AT PULSANT EXPLAINS WHY SECURE
ACCESS SERVICE EDGE (SASE) IS THE IDEAL SOLUTION FOR
USER-CENTRIC SECURITY
Despite the widescale shift towards
dispersed working, many businesses still
haven't addressed the long-term security
risks associated with an expanded attack
surface. The problem is employees are now
working from uncontrolled environments.
Personal devices and home networks don't
have the same security protocols and controls
as corporate devices and networks, making
them more prone to cyber attacks. In a remote
environment there is usually little control over
what can be reached over the internet, with
access often shared with other devices, posing
further risks. Many home networks also aren't
password-protected, use easily guessed or
default passwords, or may be configured
without encryption, providing a far easier
avenue for an attacker to gain access to a
corporate network.
REMOVING THE IT HEADACHE
For IT teams this presents a huge headache.
Applying security policies to each remote worker
can be a complex and expensive venture. For
example, applying the same policies and
controls could require deploying a firewall at
each employee's home which is not only
expensive, but creates huge management
overheads. Alternatively, each employee could
be provided with a remote VPN connection
back to a central office location, but as
organisations increasingly move to decentralised
services with SaaS and public cloud, it doesn't
make sense to route traffic back through an
office location.
THE ROLE OF SASE
Secure Access Service Edge (SASE) is the
ideal solution for user-centric security, where
policies can be applied directly to employees,
wherever they are working, using a
centralised management policy. However,
much of what SASE is, or isn't, is yet to be
truly defined or standardised.
Gartner defines SASE as an extension of SD-
WAN to include other network security controls
and services that can be centrally managed
through the same SD-WAN management
plane. Many vendors have jumped on the
SASE bandwagon and are using it to describe
cloud-based security solutions that are not
managed by a single management dashboard
and actually involve multiple separate
products. Others are claiming to provide SASE
even without an SD-WAN offering, while some
offer elements of SASE but not the full product
range. Currently there are very few vendors in
who offer SASE as per Gartner's full definition,
but this doesn't mean that SASE isn't something
that organisations should consider.
ZERO-TRUST POLICIES
At its core SASE is about the application and
the user. With SD-WAN, it's about having
control over the application and applying
routing policies to make sure that the right
applications get the best possible path. This
delivers a better end user experience and
enables organisations to change or bring on
new applications efficiently and quickly.
SASE refers to applying the same principles of
efficiency and agility to security controls. The
application and the user are still considered,
but more specifically the right user getting to
the right applications and only those
applications. This can even be broken down
further to the right device, at the right time of
day, from the right network, and access
restricted to applications and web services
based on the security posture of the user,
device, and destination.
The physical location of the SASE 'engine'
should be considered. The term cloud implies
that something is located everywhere, when in
the UK this typically means it's hosted in one
location. By having regional points-ofpresence,
the enforcement of security policies
is distributed closer to each user wherever they
are working. Using this approach,
organisations can stop employees from
accessing known bad web services, regardless
of location, removing the risk of downloading
malicious files or applications. If malware does
get through and a device is breached, access
can be revoked, preventing attackers from
gaining access to applications or services.
SECURING THE EDGE
SASE forms a comprehensive package that
combines a variety of solutions, and as
organisations move towards distributed and
decentralised applications, SASE and SD-WAN
provide agile and flexible central controls.
Remote working policies are now permanent
and widespread, and in the near future, SASE
and SD-WAN will enable both IT and security
teams to bring security protocols closer to users.
The outcome will be a highly-resilient network
that truly supports its users and protects them
from emerging and increasingly sophisticated
cyber threats - wherever they are. NC
10 NETWORKcomputing NOVEMBER/DECEMBER 2021 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK