Navigating the SASE Landscape

A step-by-step roadmap to successfully implement SASE.

Networking and security have traditionally been separate solutions layered into complex architectures. While some vendors attempted to combine security into their networking gear, this often meant throwing more boxes at customers or stitching basic filtering into their gear. This further complicated corporate infrastructures by deploying multiple tools from multiple vendors, and none of them seamlessly worked well together or shared context. Realizing this chaos required a better solution. Several vendors pursued efforts to bring networking and security together in a single solution, to varying degrees of success. And in 2019, Gartner defined these efforts as SASE, or Secure Access Service Edge.

SASE is the convergence of networking and security into a single, cloud-native platform that delivers SD-WAN, firewall as a service (FWaaS), cloud access security broker (CASB), zero trust network access (ZTNA), and other security technologies. Gartner also specified that management of these functions should be possible via a single management application for simplicity. This would eliminate the need for on-premises infrastructure, increasing visibility and control while reducing the attack surface and offering a better overall user experience.

Additional security features, such as next gen malware detection and intrusion prevention, are inherent parts of SASE and help mitigate cyber threats. SASE provides additional benefits such as accelerating cloud adoption by enabling secure access to cloud services and applications and helping organizations to meet regulatory compliance requirements.

SASE offers subscription-based pricing models, eliminating the need for upfront investment and managing complex licensing models. SASE promises simplified IT operations, eliminating the need to manage disparate networking and security tools. However, translating the SASE adoption vision into reality can be daunting. Decoding SASE

The intricacies of implementing SASE may leave security professionals with questions about approaches, requirements, and adoption strategies.

Here's a step-by-step roadmap to successfully implement SASE:

1. Evaluate if SASE is right for you: The decision to adopt SASE architecture is significant. Organizations must evaluate their existing security architecture and identify critical gaps. While Gartner states that 40% of enterprises will adopt SASE strategies in 2024, organizations still need to prepare for its roll-out. Consider the right timing for SASE. For instance, a good window for SASE adoption might be when renewing your existing WAN contracts.

2. Define the use cases you want to address: Kick off your SASE journey by articulating the problems you want to solve. Are you trying to improve network performance? Is your focus on ensuring reliability? Is your end goal about reducing the cost of managing disparate security tools? Or are you concerned about achieving compliance requirements? A well-defined problem statement and a prioritized list of use cases will guide the implementation. It's crucial to envision the desired architecture based on business needs. This involves gaining clarity on specific problems to solve and considering potential trade-offs.

3. Introspect: It is important to ask if SASE aligns well with the prioritized use cases and if your teams have the required skill set and knowledge to implement and manage it. This will help you map what your journey will look like and note penalties or risks associated with the approach. These questions will assist in planning and preparing for the implementation of SASE. Additionally, gaining buy-in from the board is an important exercise to undertake. SASE is just as much of a business discussion as it is a technical one. Articulating how your plan for SASE mitigates strategic risk, security risk, and financial risk, will provide the easiest path to approval with the board.

4. Pick a suitable partner: The next step entails choosing a vendor partner that aligns with the prioritized use cases for your organization. Evaluate your existing network architecture, security policies, security controls, and budget. Consider the vendor’s customer references and experience in the market, their architecture, product features, ease of implementation, and services and support provided. Avoid creating a patchwork of multiple products; opt for a single, converged platform. Also, evaluate your compliance requirements (PCI-DSS, NIST, GDPR, etc.) and how the vendor’s solution aligns with this. It's important to create an exhaustive implementation plan, including timelines, budget, and allocating resources.

5. Design your “to-be” architecture and perform pre-deployment checks: Your network design and business outcome decisions are non-negotiable parts of deploying SASE. Once you’ve determined your business and technical objectives, concentrate on your infrastructure specifications, focusing on your “must-have”, “should-have”, and “nice-to-have” capabilities. This is your chance to customize your SASE architecture to suit your requirements.

Here’s a brief list to consider:

  • Identify and inventory resources in the cloud and on-premises.
  • Classify apps by type, criticality, sensitivity, and requirements.
  • Define user types, device postures, and authorization levels.
  • Understand network topology and internet connectivity details between sites — spanning connection technologies, bandwidth choice, and backup links.
  • Define your security policies.

6. Deployment: Crawl, walk, and run approach: Dispel the misconception that SASE must be implemented all at once. For most companies, the thought of deploying all SASE technologies simultaneously seems unrealistic and inherently brings complexity and risks. While SASE represents a single converged solution, it doesn’t necessitate a singular deployment. It's important to gradually deploy over time to meet specific IT and business needs and adopt a multi-phase journey comprising diverse SASE technology implementations. To build experience and expertise, start with POCs and smaller deployments. Expand the spectrum of your SASE implementation over time to onboard new sites, apps, and users and migrate existing infrastructure components to SASE. After deployment, optimize and continuously monitor the implementation.

Moving to a SASE architecture brings uncertainty. SASE implementation also presents challenges like change management, subscription costs, and supplementary security measures like zero trust and data loss prevention (DLP). Getting buy-in and sponsorship from the board can pose another set of challenges and there could be added resistance from business and IT teams. These challenges necessitate clearly articulating the benefits of SASE to various stakeholders, managing misconceptions, and providing thorough training sessions.

It is also critical to drive the cultural shift within the network and security team. Ensure that SASE can coexist and integrate with existing network and security solutions.

SASE is a robust architecture poised to manage the evolving challenges of the modern enterprise. Deploying SASE necessitates meticulous consideration of specific requirements and expectations. A well-defined plan, adjusted to the considerations of CxOs, is vital for successful SASE implementation.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • The Power of a Layered Approach to Safety

    In a perfect world, every school would have an unlimited budget to help secure their schools. In reality, schools must prioritize what budget they have while navigating the complexities surrounding school security and lockdown. Read Now

  • How a Security System Can Enhance Arena Safety and the Fan Experience

    Ensuring guests have both a memorable experience and a safe one is no small feat for your physical security team. Stadiums, ballparks, arenas, and other large event venues are increasingly leveraging new technologies to transform the fan experience and maintain a high level of security. The goal is to preserve the integrity and excitement of the event while enhancing security and remaining “behind the scenes.” Read Now

  • Protecting Data is Critical

    To say that the Internet of Things (IoT) has become a part of everyday life would be a dramatic understatement. At this point, you would be hard-pressed to find an electronic device that is not connected to the internet. Read Now

Featured Cybersecurity

Webinars

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3