Navigating the SASE Landscape

A step-by-step roadmap to successfully implement SASE.

• By Demetris Booth
• Jan 18, 2024

Networking and security have traditionally been separate solutions layered into complex architectures. While some vendors attempted to combine security into their networking gear, this often meant throwing more boxes at customers or stitching basic filtering into their gear. This further complicated corporate infrastructures by deploying multiple tools from multiple vendors, and none of them seamlessly worked well together or shared context. Realizing this chaos required a better solution. Several vendors pursued efforts to bring networking and security together in a single solution, to varying degrees of success. And in 2019, Gartner defined these efforts as SASE, or Secure Access Service Edge.

SASE is the convergence of networking and security into a single, cloud-native platform that delivers SD-WAN, firewall as a service (FWaaS), cloud access security broker (CASB), zero trust network access (ZTNA), and other security technologies. Gartner also specified that management of these functions should be possible via a single management application for simplicity. This would eliminate the need for on-premises infrastructure, increasing visibility and control while reducing the attack surface and offering a better overall user experience.

Additional security features, such as next gen malware detection and intrusion prevention, are inherent parts of SASE and help mitigate cyber threats. SASE provides additional benefits such as accelerating cloud adoption by enabling secure access to cloud services and applications and helping organizations to meet regulatory compliance requirements.

SASE offers subscription-based pricing models, eliminating the need for upfront investment and managing complex licensing models. SASE promises simplified IT operations, eliminating the need to manage disparate networking and security tools. However, translating the SASE adoption vision into reality can be daunting. Decoding SASE

The intricacies of implementing SASE may leave security professionals with questions about approaches, requirements, and adoption strategies.

Here's a step-by-step roadmap to successfully implement SASE:

1. Evaluate if SASE is right for you: The decision to adopt SASE architecture is significant. Organizations must evaluate their existing security architecture and identify critical gaps. While Gartner states that 40% of enterprises will adopt SASE strategies in 2024, organizations still need to prepare for its roll-out. Consider the right timing for SASE. For instance, a good window for SASE adoption might be when renewing your existing WAN contracts.

2. Define the use cases you want to address: Kick off your SASE journey by articulating the problems you want to solve. Are you trying to improve network performance? Is your focus on ensuring reliability? Is your end goal about reducing the cost of managing disparate security tools? Or are you concerned about achieving compliance requirements? A well-defined problem statement and a prioritized list of use cases will guide the implementation. It's crucial to envision the desired architecture based on business needs. This involves gaining clarity on specific problems to solve and considering potential trade-offs.

3. Introspect: It is important to ask if SASE aligns well with the prioritized use cases and if your teams have the required skill set and knowledge to implement and manage it. This will help you map what your journey will look like and note penalties or risks associated with the approach. These questions will assist in planning and preparing for the implementation of SASE. Additionally, gaining buy-in from the board is an important exercise to undertake. SASE is just as much of a business discussion as it is a technical one. Articulating how your plan for SASE mitigates strategic risk, security risk, and financial risk, will provide the easiest path to approval with the board.

4. Pick a suitable partner: The next step entails choosing a vendor partner that aligns with the prioritized use cases for your organization. Evaluate your existing network architecture, security policies, security controls, and budget. Consider the vendor’s customer references and experience in the market, their architecture, product features, ease of implementation, and services and support provided. Avoid creating a patchwork of multiple products; opt for a single, converged platform. Also, evaluate your compliance requirements (PCI-DSS, NIST, GDPR, etc.) and how the vendor’s solution aligns with this. It's important to create an exhaustive implementation plan, including timelines, budget, and allocating resources.

5. Design your “to-be” architecture and perform pre-deployment checks: Your network design and business outcome decisions are non-negotiable parts of deploying SASE. Once you’ve determined your business and technical objectives, concentrate on your infrastructure specifications, focusing on your “must-have”, “should-have”, and “nice-to-have” capabilities. This is your chance to customize your SASE architecture to suit your requirements.

Here’s a brief list to consider:

• Identify and inventory resources in the cloud and on-premises.
• Classify apps by type, criticality, sensitivity, and requirements.
• Define user types, device postures, and authorization levels.
• Understand network topology and internet connectivity details between sites — spanning connection technologies, bandwidth choice, and backup links.
• Define your security policies.

6. Deployment: Crawl, walk, and run approach: Dispel the misconception that SASE must be implemented all at once. For most companies, the thought of deploying all SASE technologies simultaneously seems unrealistic and inherently brings complexity and risks. While SASE represents a single converged solution, it doesn’t necessitate a singular deployment. It's important to gradually deploy over time to meet specific IT and business needs and adopt a multi-phase journey comprising diverse SASE technology implementations. To build experience and expertise, start with POCs and smaller deployments. Expand the spectrum of your SASE implementation over time to onboard new sites, apps, and users and migrate existing infrastructure components to SASE. After deployment, optimize and continuously monitor the implementation.

Moving to a SASE architecture brings uncertainty. SASE implementation also presents challenges like change management, subscription costs, and supplementary security measures like zero trust and data loss prevention (DLP). Getting buy-in and sponsorship from the board can pose another set of challenges and there could be added resistance from business and IT teams. These challenges necessitate clearly articulating the benefits of SASE to various stakeholders, managing misconceptions, and providing thorough training sessions.

It is also critical to drive the cultural shift within the network and security team. Ensure that SASE can coexist and integrate with existing network and security solutions.

SASE is a robust architecture poised to manage the evolving challenges of the modern enterprise. Deploying SASE necessitates meticulous consideration of specific requirements and expectations. A well-defined plan, adjusted to the considerations of CxOs, is vital for successful SASE implementation.