Secure Access Service Edge (SASE)

¿Qué es SASE?

Secure Access Service Edge (SASE), pronounced “sassy,” is a cloud-based architecture that delivers network and security services meant to protect users, applications, and data. This term was coined by Gartner in 2019 and has quickly risen through the ranks to become one of the top aspirational security concepts of the current decade so far. Given that many users and applications no longer live and operate on a corporate network, access and security measures can’t depend on conventional hardware appliances in the corporate datacenter.

SASE promises to deliver the necessary networking and security capabilities in the form of cloud-delivered services. Done properly, a SASE model eliminates perimeter-based appliances and legacy solutions. Instead of delivering the traffic to an appliance for security, users connect to the SASE cloud service to safely access and use web services, applications, and data with the consistent enforcement of security policy.

Where is the “edge” in Secure Access Service Edge?
The “edge” in SASE refers to the cloud provider’s global systems that exist on their hardware (data centers and devices). Users access cloud services by logging in and authenticating their identities, from any location, and are passed through this “edge” into the cloud environment.

sase meaning


White Paper: SASE and the Seven Forces Shaping Security Transformation
Blog: A CISOs View of SASE


 

Why is SASE important?

Las medidas de seguridad convencionales suponían que las aplicaciones y los usuarios estarían dentro del perímetro de la red, algo que ya no es así. Los datos de las empresas se están trasladando a la nube, los empleados teletrabajan cada vez más y las iniciativas de transformación digital requieren que las organizaciones de TI sean ágiles para aprovechar las nuevas oportunidades de negocio.

As a result, the traditional network perimeter is dissolving, and new models for access controls, data protection, and threat protection are necessary. In light of these changes, organizations are finding that their existing collection of standalone point products such as firewalls, secure web gateway, data loss prevention (DLP), and cloud access security brokers (CASB), are no longer applicable in a cloud-first world.

Predicciones de Gartner sobre SASE

 

20% of enterprises will adopt SWG, CASB, ZTNA and branch FWaaS by 202340% of enterprises will develop strategies to adopt SASE by 2024
 

de las empresas adoptarán SWG, CASB, ZTNA y FWaaS para sus sucursales de aquí a 2023

 

de las empresas desarrollarán estrategias para adoptar SASE de aquí a 2024

SOURCE: GARTNER REPORT: THE FUTURE OF NETWORK SECURITY IS
IN THE CLOUD

 

¿Cómo es una arquitectura SASE?

Secure Access Service Edge, or SASE, unifies networking and security services in a cloud-delivered architecture to protect users, applications, and data everywhere. Given that users and applications are no longer on a corporate network, security measures can’t depend on conventional hardware appliances at the network edge.

SASE diagram

There are two sides of SASE architecture: Security and Networking

Instead, SASE promises to deliver the necessary networking and security as cloud-delivered services. Done properly, a SASE model eliminates perimeter-based appliances and legacy solutions. Instead of delivering the traffic to an appliance for security, users connect to the SASE cloud service to safely use applications and data with the consistent enforcement of security policy.


Blog: Cómo gestionar con seguridad su transición a la nube
Blog: Cómo plantearse la hoja de ruta estratégica de Gartner para la convergencia SASE"


 

SASE Includes the Following Technologies and Capabilities

Una arquitectura SASE es capaz de identificar a los usuarios y los dispositivos, aplicando controles de seguridad basados en políticas y ofreciendo un acceso seguro a las aplicaciones y los datos correctos. SASE permite proporcionar un acceso seguro con independencia de la ubicación de los usuarios, los datos, las aplicaciones o los dispositivos.

  • Microservicios nativos de la nube en una arquitectura de plataforma única
  • Capacidad para inspeccionar tráfico con cifrado SSL/TLS a escala cloud
  • Inline proxy capable of decoding cloud and web traffic (Next-Generation Secure Web Gateway/NG SWG)
  • Firewall and intrusion protection for all ports and protocols (Firewall as a Service/FWaaS)
  • Managed cloud service API integration for data-at-rest (Cloud Access Security Broker/CASB)
  • Public cloud IaaS continuous security assessment (Cloud Security Posture Management/CSPM)
  • Advanced data protection for data-in-motion and at-rest (Data Loss Prevention/DLP)
  • Protección avanzada frente a amenazas, entre otros, IA/aprendizaje automático, UEBA, entornos aislados, etc. (ATP)
  • Threat intelligence sharing and integration with EPP/EDR (Endpoint Protection Platform/Endpoint Detection and Response), SIEM (Security Information and Event Management), and SOAR (Security Orchestration, Automation, and Response)
  • Software-defined perimeter with zero trust network access, replacing legacy VPNs (SDP, ZTNA)
  • Protection for the branch, including support for branch networking initiatives such as SD-WAN (Software-Defined Wide Area Network)
  • Carrier-grade, hyper-scale network infrastructure with a global POP (Point of Presence) footprint

Blog: Where CASB and SWG and Headed
Blog: No estrangule su SASE


 

What are the Benefits of SASE?

1. Flexibility:
Allows for direct-to-net or direct-to-cloud access from anywhere for easy adoption of new digital business models

2. Cost savings:
Elimina inversiones en activos fijos (CapEx) para infraestructura local y ofrece unos gastos de explotación (OpEx) inferiores y predecibles gracias a su modelo de seguridad como servicio.

3. Reduced complexity:
Consolidated services into a cloud-delivered model eliminates complex stack of legacy point solutions and simplifies operational effort

4. Increased performance:
Enhances and accelerates access to internet resources via a global network infrastructure optimized for low-latency, high-capacity, and high-availability

5. Zero trust network access:
Proporciona un acceso seguro y contextual a aplicaciones privadas en nubes públicas/privadas.

6. Threat protection:
Detiene los ataques a la web y a la nube, como el phishing en la nube, el malware, el ransomware y los usuarios internos malintencionados.

7. Data protection:
Protege los datos allá donde vayan, dentro y fuera de la organización, incluidas las nubes públicas, así como entre instancias personales y de la empresa en las aplicaciones en la nube.

 

What are the Four Questions to Ask When Adopting SASE?

1. How does your current web or cloud security give you full visibility and context across all web and cloud traffic?

Considere la posibilidad de consolidar su proxy web (SWG) y el agente de seguridad de acceso a la nube (CASB). De este modo, dispondrá de una visibilidad y control críticos para la protección frente a la pérdida de datos (DLP) y defensas de protección avanzada frente a amenazas (ATP) que también se encuentran alojadas en la nube en la misma plataforma. Además de retirar sus appliances SWG o Web Proxy legacy, migre al acceso a la red Zero Trust (ZTNA) para sustituir sus antiguos appliances VPN y modernizar su estrategia de acceso seguro global.

2. What level of cloud-scale does your current security solution provide?

La mayor parte del tráfico de la nube está cifrado y un número cada vez mayor de atacantes están aprovechando la nube para evadir los controles tradicionales de la red. Usar la inspección SSL/TLS a nivel de la nube le ayuda a estar al tanto del panorama de las amenazas.

3. Does your current network support high performance and consistent availability?

Users expect high performance with low latency, because if the SASE is slow, unhappy users will look for ways around your system. In order to deliver great user experience, make sure that your SASE solution is engineered for high performance and located in the places that your users are.

4. How many consoles and policies do you currently have to use to manage your existing security stack?

Many vendors are adapting or virtualizing their software and calling it a cloud-based solution. If it isn’t designed to be a SASE, you may end up with multiple administrative consoles, complex policies that are hard to manage, and time-wasting tools for conducting investigations. Choose a solution that has a single management console, single client, and a single policy engine to streamline operations and effectiveness for network and security teams.


For more information on SASE, download Netskope’s SASE Resource Pack and SASE Adoption Guide.

 

Become a SASE Expert

Sponsored by Netskope, The SASE Accreditation is an introductory training on Secure Access Service Edge (SASE), an architectural framework for security and networking that addresses the security challenges modern organizations face as they embrace cloud applications, protect data, and unify networking and security services.

 

In this two-day accreditation, you will learn how SASE helps networking and security professionals gain greater visibility and real-time actionable information about cloud services, activity, traffic, and data while also simplifying your security stack.

Recursos

Subscribe for the latest cloud security insights

By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.