View source for Secure Access Service Edge (SASE)

{{short description|Secure Access Service Edge}}
SASE is an acronym for '''Secure Access Service Edge'''. Coined by analyst firm [[Company:Gartner|Gartner]], SASE simplifies [[Wide area network|wide-area networking (WAN)]] and [[Computer security|security]] by delivering both as a [[Cloud computing|cloud]] service directly to the source of connection ([[User (computing)|user]], device, [[Finance:Branch office|branch office]], [[Internet of things|IoT device]], [[Edge computing|edge computing]] location) rather than the [https://www.gartner.com/en/documents/3957375/invest-implications-the-future-of-network-security-is-in enterprise data center]. [[Computer security|Security]] is based around [[Digital identity|identity]], real-time context and enterprise [[Computer security|security]] and compliance policies. An [[Digital identity|identity]] may be attached to anything from a person/[[User (computing)|user]] to a device, [[Finance:Branch office|branch office]], [[Cloud computing|cloud]] service, application, [[Internet of things|IoT]] system, or an [[Edge computing|edge computing]] location [1].

SASE is meant to be a simplified [[Wide area network|WAN]] and [[Network security|security]] solution for a [[Mobile computing|mobile]], global workplace that relies on cloud applications and data. The common solution of [[Engineering:Backhaul (telecommunications)|backhauling]] all [[Wide area network|WAN]] traffic over long distances to one or a few corporate data centers for [[Computer security|security]] functions adds network [[Engineering:Latency (engineering)|latency]] when [[User (computing)|users]] and their [[Cloud computing|cloud]] application are globally dispersed, rather than on-premises [1]. By targeting services to the [[Edge computing|edge]] at the connection source, SASE eliminates the [[Engineering:Latency (engineering)|latency]] caused by [[Engineering:Backhaul (telecommunications)|backhauling]].

== Overview ==
SASE combines [[SD-WAN]] with a stack of [[Computer security|security]] functions, including [[Software:Cloud access security broker|Cloud Access Security Brokers (CASB)]], [https://www.techopedia.com/definition/29303/secure-web-gateway Secure Web Gateways (SWG)], [[Antivirus software|antivirus/malware inspection]], virtual private networking (VPN), [[Firewall (computing)|firewall]] as a service (FWaaS), and data loss prevention (DLP), all delivered by a single [[Cloud computing|cloud]] service at the network [[Edge computing|edge]] [2].

SASE [[SD-WAN]] service enhancements may include [[Quality of service|traffic prioritization]], [[WAN optimization]] and converged [[Internet backbone|backbones]] to enhance reliability and maximize performance [3].

[[Wide area network|WAN]] and [[Computer security|security]] functions are typically delivered as a single service at globally dispersed SASE [[Engineering:Point of presence|points of presence (PoPs)]] located as close as possible to dispersed [[User (computing)|users]], [[Finance:Branch office|branch offices]] and [[Cloud computing|cloud]] services [1]. To access SASE services, [[Edge computing|edge]] locations or [[User (computing)|users]] connect to the closest available [[Engineering:Point of presence|PoP]]. SASE vendors may contract with several [[Internet backbone|backbone]] providers and [[Peering|peering]] partners to offer customers fast, low-[[Engineering:Latency (engineering)|latency]] [[Wide area network|WAN]] performance for long-distance [[Engineering:Point of presence|PoP]]-to-PoP connections [1].

== History and Drivers ==

The term SASE was coined by [[Company:Gartner|Gartner]] analysts Neil McDonald and Joe Skorupa and described in a [https://www.gartner.com/en/documents/3947237 July 29, 2019 Networking Hype Cycle] [4] and [https://www.gartner.com/en/documents/3953690/market-trends-how-to-win-as-wan-edge-and-security-conver Market Trends Report, How to Win as WAN Edge and Security Converge into the Secure Access Service Edge] [5] and an  August 30, 2019 [[Company:Gartner|Gartner]] report, The Future of Network Security is in the Cloud [1].

SASE is driven by the rise of [[Mobile computing|mobile]], [[Edge computing|edge]] and [[Cloud computing|cloud]] computing in the enterprise at the expense of the LAN and corporate [[Data center|data center]]. As [[User (computing)|users]], applications and [[Data|data]] move out of the enterprise [[Data center|data center]] to the [[Cloud computing|cloud]] and network [[Edge computing|edge]], moving [[Computer security|security]] and [[Wide area network|WAN]] to the [[Edge computing|edge]] as well is necessary to minimize [[Engineering:Latency (engineering)|latency]] and performance issues. [6].

The [[Cloud computing|cloud]] model is meant to delegate and simplify delivery of [[SD-WAN]] and [[Computer security|security]] functions to multiple [[Edge computing|edge]] computing devices and locations. Based on policy, different [[Computer security|security]] functions may also be applied to different connections and sessions from the same entity, whether [[Software as a service|SaaS]] applications, [[Social:Social media|social media]], [[Data center|data center]] applications or personal banking, according to [[Company:Gartner|Gartner]] [1].

The [[Cloud computing|cloud]] architecture boasts typical [[Cloud computing|cloud]] enhancements such as [[Elasticity (cloud computing)|elasticity]], flexibility, agility, global reach and delegated management.

== Required Characteristics ==

SASE has many characteristics and components, but the principal elements are:

* Convergence of [[Wide area network|WAN]] and network and network [[Computer security|security]] functions.
* A [[Cloud computing|cloud]]-native architecture delivering converged [[Wide area network|WAN]] and [[Computer security|security]] as a service that offers the [[Scalability|scalability]], elasticity, adaptability and self-healing typical of all [[Cloud computing|cloud]] services.
* Globally distributed fabric of [[Engineering:Point of presence|PoPs]] guaranteeing a full range of [[Wide area network|WAN]] and [[Computer security|security]] capabilities with low [[Engineering:Latency (engineering)|latency]], wherever business offices, [[Cloud computing|cloud applications]] and [[Mobile computing|mobile users]] are located. To deliver low [[Engineering:Latency (engineering)|latency]] at any location, SASE [[Engineering:Point of presence|PoPs]] have to be more numerous and extensive than those offered by typical public [[Cloud computing|cloud]] providers and SASE providers must have extensive [[Peering|peering]] relationships.
* [[Digital identity|Identity]]-driven services. An [[Digital identity|identity]] can be attached to anything from a person or [[Finance:Branch office|branch office]] to a device, application, service, [[Internet of things|IoT]] device or [[Edge computing|edge computing]] location at the source of connection. [[Digital identity|Identity]] is the most significant context affecting SASE [[Computer security|security]] policy. However, location, time of day, risk/trust posture of the connecting device and application and data sensitivity will provide other real-time context determining the  [[Computer security|security]] services and policies applied to and throughout each WAN session.
* Support for all edges equally, including physical locations, [[Cloud computing|cloud]] data centers, [[User (computing)|users]]’ mobile devices and [[Edge computing|edge computing]], with placement of all capabilities at the local [[Engineering:Point of presence|PoP]] rather than the edge location. [[Edge computing|Edge]] connections to the local [[Engineering:Point of presence|PoP]] may vary from an [[SD-WAN]] for a [[Finance:Branch office|branch office]] to a VPN client or clientless [[World Wide Web|Web]] access for a [[Mobile computing|mobile]] [[User (computing)|user]], to multiple tunnels from the [[Cloud computing|cloud]] or direct cloud connections inside a global [[Data center|data center]]. [6]

== Features ==

[[Company:Gartner|Gartner]] and others have cited numerous features/benefits of a SASE architecture for the [[Mobile computing|mobile]], [[Cloud computing|cloud]] enabled enterprise. These include:

===Reduced Complexity===

Reduced Complexity that comes with the [[Cloud computing|cloud]] model and a single vendor for all [[Wide area network|WAN]] and [[Computer security|security]] functions, vs. multiple security appliances from multiple vendors at each location. Reduced complexity also comes from a single-pass architecture that [[Encryption|decrypts]] the traffic stream and inspects it once with multiple policy engines rather than chaining multiple inspection services together.

===Universal Access===

Universal Access A SASE architecture is architected to provide consistent fast, secure access to any resource from any entity at any location, as opposed to access primarily based around the corporate [[Data center|data center]].

===Cost Efficiency===

[[Cost efficiency]] of the [[Cloud computing|cloud]] model, which shifts up-front capital costs to monthly subscription fees, consolidates providers and vendors, and reduces the number of physical and [[Virtualization|virtual]] [[Finance:Branch office|branch]] appliances and software agents IT has to purchase manage and maintain in-house. Cost reduction also comes from delegation of maintenance, upgrades and [[Computer hardware|hardware]] refreshes to the SASE provider.

===Performance===

Performance of applications and services enhanced by [[Engineering:Latency (engineering)|latency]]-optimized [[Routing|routing]], which is particularly beneficial for [[Engineering:Latency (engineering)|latency]]-sensitive [[Engineering:Digital video|video]], [[Engineering:Voice over IP|VoIP]] and [[Collaborative software|collaboration applications]]. SASE providers can optimize and route traffic through high-performance [[Internet backbone|backbones]] contracted with carrier and [[Peering|peering]] partners.

===Ease of Use===

'''[[Usability|Ease of Use]]''' Depending on the implementation, SASE is likely to reduce the number of apps and agents required for a device to a single app and provides a consistent experience to the [[User (computing)|user]] regardless of where they are or what they are accessing.

===Consistent Security===

'''Consistent''' [[Computer security|Security]] via a single [[Cloud computing|cloud]] service for all [[Wide area network|WAN]] [[Computer security|security]] functions and [[Wide area network|WAN]] connections. [[Computer security|Security]] is based on the same set of policies, with the same security functions delivered by the same [[Cloud computing|cloud]] service to any access [[Session (computer science)|session]], regardless of application, [[User (computing)|user]] or device location and destination ([[Cloud computing|cloud]], [[Data center|data center]] application). Once the SASE provider adapts to a new threat, the adaption can be available to all the [[Edge computing|edges]]. [1]

== Criticism of SASE ==

Criticism of SASE has come from several sources, including [[Company:International Data Corporation|IDC]] and [[Company:IHS Markit|IHS Markit]], as cited in a November 9, 2019 sdxcentral post written by Tobias Mann.<ref name="sdxcentral">{{cite web|url=https://www.sdxcentral.com/articles/news/analysts-debate-sases-merits-as-vendors-board-the-hype-train/2019/11/|title=Analysts Debate SASE&#039;s Merits as Vendors Board Hype Train|website=SDxCentral|accessdate=2019-11-18}}</ref> Both analyst firms criticize SASE as a [[Company:Gartner|Gartner]] term that is neither a new market, [[Engineering:Technology|technology]] nor product, but rather an integration of existing technology with a single source of management.

Clifford Grossner of IHS Markit criticizes the lack of [[Analytics|analytics]], [[Artificial intelligence|artificial intelligence]] and [[Machine learning|machine learning]] as part of the SASE concept and the likelihood that enterprises won't want to get all [[SD-WAN]] and [[Computer security|security]] functions from a single vendor. [[Company:Gartner|Gartner]] counters that service chaining of [[Computer security|security]] and [[SD-WAN]] functions from multiple vendors yields “inconsistent services, poor manageability and high [[Engineering:Latency (engineering)|latency]].” [7]

IDC analyst Brandon Butler cites IDC's position that [[SD-WAN]] will evolve to SD-Branch, defined as centralized deployment and management of virtualized [[SD-WAN]] and [[Computer security|security]] functions at multiple [[Finance:Branch office|branch office]] locations.

Nevertheless, [[Company:Cato Networks|Cato Networks]], [[Company:Infoblox|Infoblox]], and [https://www.sdxcentral.com/articles/news/palo-alto-networks-leaps-into-sase-market/2019/11/ Palo Alto] [8] have introduced offerings in the SASE market.

== Complementary Technology ==

===[[SD-WAN]]===

[[SD-WAN]] is a maturing technology that simplifies wide area networking through centralized control of the networking hardware or software that directs traffic across the [[Wide area network|WAN]]. It also allows organizations to combine or replace private [[Wide area network|WAN]] connections with [[Internet]] [[Engineering:Broadband|broadband]], [[Engineering:LTE (telecommunication)|LTE]] and/or 5g connections. The central controller sets policies and prioritizes, optimizes and routes [[Wide area network|WAN]] traffic, selecting the best link and path dynamically for optimum performance. SD-WAN vendors may offer some [[Computer security|security]] functions with their [[SD-WAN]] virtual or physical appliances, which are typically deployed at the [[Data center|data center]] or [[Finance:Branch office|branch office]].

Typically SASE incorporates [[SD-WAN]] as part of a [[Cloud computing|cloud]] service that also delivers mobile access and a full [[Computer security|security]] [[Solution stack|stack]] delivered from a local [[Engineering:Point of presence|PoP]].

===Network as a Service (NaaS)===

SASE and [[Network as a service|NaaS]] overlap in concept. [[Network as a service|NaaS]] delivers virtualized network infrastructure and services using a [[Cloud computing|cloud]] subscription business model. Like SASE it offers reduced complexity and management costs. Typically, different [[Network as a service|NaaS]] providers offer different service packages, such as a package of [[Wide area network|WAN]] and secure VPN's as a service, [[Dynamic bandwidth allocation|bandwidth on demand]], or hosted networks as a service. By contrast SASE is meant to be a single comprehensive secure [[SD-WAN]] solution for branch offices, [[Mobile computing|mobile]] [[User (computing)|users]], data centers and any other secure enterprise [[Wide area network|WAN]] requirement. [9]

===[[Next-generation firewall|Next Generation Firewall (NGFW)]]===

[[Next-generation firewall|NGFW]] combines a traditional [[Firewall (computing)|firewall]] with other [[Computer security|security]] and networking functions geared to the virtualized [[Data center|data center]]. [[Computer security|Security]] functions include application control, deep and encrypted [[Social:Deep packet inspection|packet inspection]], [[Intrusion detection system|intrusion prevention]], [[Social:Content-control software|Web site filtering]], anti-malware, [[Identity management|identity management]], [[Threat Intelligence Platform|threat intelligence]] and even [[Wide area network|WAN]] [[Quality of service|quality of service]] and [[Bandwidth management|bandwidth management]]. [10]

[[Next-generation firewall|NGFW]] offers a subset of the [[Computer security|security]] stack offered by SASE, and typically doesn't include [[SD-WAN]] services. [[Next-generation firewall|NGFW]] may be deployed on premises or as a [[Cloud computing|cloud]] service, while SASE is a [[Cloud computing|cloud]] architecture by definition. While SASE focuses [[Computer security|security]] on [[Wide area network|WAN]] connections, a NGFW can be deployed anywhere including internally in the [[Data center|data center]].

===Firewall as a Service (FWaaS)===

FWaaS is a [[Firewall (computing)|firewall]] offered as a [[Cloud computing|cloud]] service, rather than on premises as software or hardware. Most FWaaS providers offer [[Next-generation firewall|NGFW]] capabilities. [11] Typically, an entire organization is connected to a single FWaaS [[Cloud computing|cloud]] with no requirement for maintaining its own [[Firewall (computing)|firewall]] infrastructure. SASE combines [[Edge computing|edge]] FWaaS with other [[Computer security|security]] functions and [[SD-WAN]] [1].

==Marketplace==

[[Company:Gartner|Gartner]] classifies SaaS as an emerging market with several vendors offering a large number of SASE capabilities, but no single provider offering the entire SASE portfolio. It lists 14 companies in several market categories as SASE players, including [[Company:Cisco|Cisco]], [[Company:Akamai Technologies|Akamai]], [[Company:Palo Alto Networks|Palo Alto Networks]], [[Company:Broadcom Inc.|Symantec]], [[Company:VMware|VMware]], and [[Company:Cato Networks|Cato Networks]], and expects some of the major [[Cloud computing|cloud]] providers to move into this category. [[Company:Gartner|Gartner]] doesn't expect a complete SASE offering to be available until sometime in 2020. [1]

==References==
{{reflist}}
[1] L. O. J. S. Neil MacDonald, "The Future of Network Security is in the Cloud," Gartner, 2019.

[2] "The Network for Digital Business Starts with the Secure Access Service Edge (SASE)," Cato
Networks, 2019.

[3] M. Conran, "The Evolution to Secure Access Service Edge (SASE) is Being Driven by Necessity,"
Network World , 24 October 2019.

[4] D. Y. Andrew Lerner, "Hype Cycle for Enterprise Networking 2019," Gartner, 2019.

[5] J. S. Neal MacDonald, "Market Trends: How to Win as WAN Edge and Security Converge into the
Secure Service Access Edge," Gartner, 2019.

[6] M. Conran, "Secure Access Service Edge (SASE): A Reflection of our Times," Network World,
October 2019.

[7] T. Mann, "Analysts Debate SASE&#39;s Merits as Vendors Board Hype Train," SDXCentral, 9 November
2019.

[8] T. Mann, "Palo Alto Networks Leaps Into SASE Market," SDXCentral, 16 November 2019.

[9] D. Greenfield, "NaaS Meets SD-WAN: What is NaaS Anyway and How Will it Impact Your SaaS,
PaaS, and Cloud Strategy," Cato Networks, 2019.

[10] C. Brook, "What is a Next Generation Firewall? Learn About the Differences NGFW and Traditional
Firewalls," Digital Guardian, 24 October 2019.

[11] "What is Firewall as a Service (FWaaS) and Why You Need It," Cato Networks, 2018.


[[Category:Wide area networks]]

{{Sourceattribution|Secure Access Service Edge (SASE)|1}}