TIIS Achieves Single-Vendor SASE by Uniting Security and Networking with Netskope SSE + SD-WAN

As the Group’s IT professionals, TIIS is expected to be an early adopter of advanced initiatives and to feed the resulting knowledge and know-how back to the wider group. In pursuit of greater agility and a willingness to embrace new technology — and to avoid owning assets outright — nearly all of TIIS’s systems now run in the cloud. Naoyuki Nogaya, General Manager of the IT Infrastructure Department, IT Platform Unit, recalls that this cloud-native environment brought security challenges on two fronts: the business and the workplace. “On the business side, our security foundation hadn’t kept pace with growing use of cloud services,” he says. “We were also concerned that the trade-off between data-loss prevention and usability would become a drag on our digital transformation efforts. On the workplace side, hybrid work — which has continued well beyond the pandemic for reasons of work-life balance and talent retention — was exposing the limits of traditional perimeter-based defense.”

To resolve both challenges, TIIS launched a project in 2024 to build a zero trust, cloud-native environment that lets employees work securely anytime, anywhere. Asked about the key to success, Nogaya points to one decision: “achieving complete SASE — SSE plus SD-WAN — from a single vendor.”

In April 2024, TIIS decided to adopt Netskope SSE, which consolidates CASB, SWG (Secure Web Gateway), ZTNA (Zero Trust Network Access), and other security functions into a single platform. 

Kiyotaka Naruse, of Group 1, IT Infrastructure Section 2, IT Infrastructure Department, describes what mattered most during rollout: “Zero trust means trusting no access or communication by default, but we were concerned that applying overly granular controls from day one would complicate operations and keep the environment from taking hold in the field,” he says. “So we defined broad groupings — the whole organization, individual departments, individual users — and set the communication controls each group needed. We also had to be careful with SSL decryption, which inspects the contents of traffic within SSE, since it can inadvertently block application traffic. To guard against that, we kept SSL decryption exclusions to a minimum and fine-tuned our operations to maintain strong security.”

TIIS turned to SD-WAN (Software-Defined Wide Area Network), which uses software to control the wide area network (WAN) connecting its sites. “The key was to achieve complete SASE by unifying security and networking under a single vendor,” Nogaya says, continuing: “By adding Netskope SD-WAN alongside Netskope SSE, we can apply the same security policy to devices that can’t run an agent. Combining products from multiple vendors, by contrast, tends to mean building and maintaining separate, overlapping policies. Consolidating and simplifying operations with a single vendor means we don’t have to piece together routers and other components — SASE becomes achievable through configuration alone, which is a major operational advantage.”