This is a series of articles focused on SASE. This is the second in a series of two posts.
In part one of this series, we discussed ways businesses are digitally transforming; introduced the SASE model as a new term defining convergence of network and security capabilities; the reasoning behind SASE; and what SASE means to all organizations. In this post, we’ll be covering Network Security as a Service, as well as redefining the traditional “hub-and-spoke” model through a SASE lens.
Network and Security as a Service
Properly implementing a SASE model has the potential to leapfrog network and security services ahead of business anticipation for specific solutions. Instead of being an obstacle to success, these services would help better enable businesses. The objective here is to build both network and security as a service. Yes, this is transformative in nature and requires a new mindset, but as an industry, we rarely embrace drastic changes and would rather stick with what we have done before. Even so, the value these services pose to organizations can be priceless.
While there are many capabilities that could follow the SASE model, let’s focus on just a few for now, as the pattern applies to any capable service that can be bundled into this business model.
In my experience, the main focus for networking teams is on SD-WAN, WAN optimization, bandwidth aggregation trying to address application performance, latency, and bandwidth. On the other hand, security teams desire to drastically decrease organizational risk exposure by innovating a new way of applying CASB, SWG, DLP, and Zero Trust, while still being transparent to users and providing them with secure access to the desired information.
John Burke, research leader at Nemertes Research in Mokena, IL stated that Network as a Service (NaaS) is expected to be a $22.5 billion market by 2022. The amount of visibility you get from NaaS should be one of your key selection criteria. Also, key is negotiating auditor-level visibility for the service.
Shelly Singh, from MarketsandMarkets, stated that the Security as a Service (SaaS) market size is expected to grow from $ 7.6 billion (USD) in 2018 to $16.5 billion (USD) by 2023, at a compound annual growth rate (CAGR) of 16.9% during the forecast period. The key factors driving the Security as a Service market include a mandate to follow regulatory and data protection laws, an increase in demand for cloud-based security solutions, and high cost and risks in managing on-premises security solutions.
Organizations must think about how NaaS and SaaS will help to provide the best possible end-to-end service. This planning has to outline a clear vision for the architectural approach that leverages low latency, alongside a well-integrated set of services that can be minimized and accomplished with just a few vendors instead of utilizing a number of redundant technologies. This approach will drive consolidation while minimizing operational burden and simplifying the whole ecosystem.
Redefining the “hub-and-spoke” model
In many conversations with clients, I have noticed a pattern where most of them think the “hub-and-spoke” model is outdated and needs to change. In my opinion, this model will still be used quite a bit, but with one big caveat: the “hub,” in this sense, will change its properties.
In terms of SASE, the center of the security universe is no longer a data center, but instead a user, and the spokes are all related services required for that user to do their job. Because most of these services now are in the cloud, this will drive a change in thinking. This even applies to network architects moving focus from “connectivity” to a true content delivery mechanism that provides not only speed, but also security and integrity, to the most sensitive information.
So, it should be clear now that having good visibility and control over web traffic, SaaS apps, and data flow is paramount in today’s security landscape.
The outcome of this approach to SASE will also demand that network and security teams work closer together, focusing more on understanding the true nature of identity, data flow, and session isolation. Not only from a connectivity perspective through microsegmentation, but also in its ability to deliver consistent, fast access and transparent application control regardless of where the consumed application or service resides, whether it’s inside a data center or the cloud, without hitting the hardware limitations of VPN concentrators or other licensing concerns.
It seems apparent that the future of any well connected and secure interaction will lead through a proxy. Combined with a Zero Trust security strategy, we can bring preventative controls to the surface, focusing on minimizing vulnerabilities and potential for harm, as any true risk-based security program would.
