In this lesson,
we're going to cover
the Secure Access Secure Edge,
and the Security Service Edge.
The Secure Access Secure Edge, or SASE
and the Security Service Edge, or SSE,
frameworks are network security architectures
that blend traditional network services
with comprehensive security functions.
SASE and SSE, both mark a significant evolution
from a decentralized security model
into a more unified, cloud-centric approach.
These days, our digital businesses
have transformed beyond the boundaries
of the typical corporate network
and extended our services well
beyond our traditional network perimeters and boundaries.
To help secure these deep parameterized networks,
we can utilize SASE
and SSE to provide us with a secure, fast
and reliable access to our cloud-based network resources,
no matter where our users are
and what devices they're trying to use.
First, let's take a look
at the Secure Access Secure Edge framework,
known as SASE.
Now, the Secure Access Secure Edge framework
is used to consolidate numerous wide area networking
and security functions into a single cloud native service
to ensure that secure
and seamless access for our end users can be achieved
regardless of their actual physical location.
The Secure Access Secure Edge is seen as a way
to address the challenges of securing
and connecting users and data
that's being distributed across multiple locations,
like branch offices, remote workers,
and mobile users, as well as into our cloud environments.
A key aspect of using SASE technology
is by using software defined networking
or SDN to provide security
and networking services from the cloud
rather than from traditional hardware-based appliances.
This allows for more flexibility, scalability,
and cost efficiency than using
traditional network solutions.
Secure Access Secure Edge,
or SASE solutions are typically going to include
a wide variety of security services,
including things like firewalls, VPNs,
Zero Trust Network Access,
and Cloud Access Security Brokers,
which are known as CASB.
These are all going to be delivered
through a common set of policy and management platforms,
as well as to achieve your networking goals.
SASE is going to help to address the challenges
of the modern distributed enterprise,
which is increasingly composed of mobile, cloud-based,
and multi-cloud applications
and services, as well as a large number of users
and devices that are constantly growing
and moving into larger and more distinct locations.
SASE is going to be used to provide a more secure
and efficient way of connecting all these users
and their devices back to the applications
and services that they want to use,
regardless of the location or the type of device
that they're actually going to be connecting with.
Now, all of the major cloud providers,
including Amazon Web Services, Microsoft Azure,
and the Google Cloud platform,
do offer solutions that align with the concepts
of Secure Access Secure Edge,
but each one refers to them
by a different name or acronym
depending on the specific service
or product that you're going to be referencing.
For example, in Amazon Web Services, also known as AWS,
the service that most closely aligns with SASE
is known as a VPC or Virtual Private Cloud.
Now, virtual Private Cloud provides a secure
and flexible network infrastructure
for your applications and data,
and AWS VPCs enable us
to create virtual networks in the cloud
and connect it to our on-premise data centers
or other AWS services to achieve that SASE capability.
Microsoft Azure actually has a lot of different services
that align with the SASE concept,
including Azure's Virtual WAN,
which provide secure, global
and efficient connectivity between branch offices,
data centers, and Azure resources,
as well as using Azure ExpressRoute,
which enable you to create
a dedicated private connection
between an Azure data center
and your on-premise network infrastructure.
If you happen to be using the Google Cloud platform,
they call their SASE Aligned Service
Google Cloud Interconnect.
Google Cloud Interconnect allows you
to connect your on-premise infrastructure
to the Google Cloud platform, known as GCP,
over a dedicated private connection.
They also have a service known as Google Cloud VPN,
that allows you to securely connect
your on-premise infrastructure
to your virtual private cloud network
through an IPSec VPN tunnel.
Now, it's important to realize
that these services are not exclusively SASE providers,
and the definition of SASE here
is not completely aligned
with all the features and functionality
of any single cloud service
from these cloud service providers,
but they do provide
a lot of the aspects of SASE for you,
such as having secure, flexible,
and global networking capabilities
by using these different services.
Next, let's take a look at the Security Service Edge,
also known as SSE.
The Security Service Edge framework
is a key subset of the Secure Access Secure edge model
that really focuses on the security services necessary
to protect access between our users,
devices and the cloud.
While SASE combines comprehensive WAN security services,
the Security Service Edge really only focuses on security
and determining what is required to guard your data
and your interactions in a cloud-centric world.
Them Security Service Edge is designed to address
the sophisticated threat landscape
that our modern organizations are facing,
where traditional security perimeters
are no longer in existence.
In the past, security measures
were centered around the corporate firewall,
but the advent of cloud computing, mobile workforces
and bring your own device policies or BYOD policies,
those traditional boundaries in our corporate networks
have pretty much dissolved.
So Security Service Edge has stepped into this new era
with a suite of security capabilities
that are delivered as a service
to ensure that no matter where
the data resides or travels to,
it's always under the vigilant watch
of our robust security measures.
SSE is focused on providing secure access
to the internet cloud services,
and/or private applications.
This is typically going to be done
by using technologies like Secure Web Gateways,
Cloud Access Security Brokers,
and Zero Trust Network Access.
Now, a Secure Web Gateway, or SWG,
can be used to inspect
and filter unwanted software and malware
from user initiated web and internet traffic sessions.
A cloud access security broker, or CASB,
is used as a border device
that sits between the cloud service consumer
and the cloud service providers
to monitor the activity
and enforce the security policies.
A Zero Trust Network Access, or ZTNA,
is designed to operate on the principle
that no user or device inside
or outside of the organization's network
should be trusted by default.
Now, these three technologies
all converge under the Security Service Edge framework
to form a security framework
that's both comprehensive and adaptable.
For instance, a secure web gateway
can be used by an organization
to ensure that when employees access the internet,
they're doing so without exposing the company
to a web-based threat
or violating a compliance policy.
A cloud access security broker, on the other hand,
could be employed to monitor and control the data
that's being shared with cloud applications
and to provide visibility, compliance,
data security, and threat protection for our users.
Perhaps the most crucial though,
is going to be Zero Trust Network Access,
which is redefining network security
by treating every access attempt
as if it originates from an untrusted network.
This type of Zero Trust Network Access
can be used to grant access based on the identity
and context of the user or the device,
and apply strict access controls
and not just a perimeter-based firewall approach.
This ensures that only authenticated
and authorize users and devices
will be able to access applications
and services in order to reduce the attack surface
and mitigate the risk of internal threats.
Together all these components
of the Security Service Edge can create a dynamic,
scalable, and secure framework
that can be applied consistently
across all users regardless of their location.
This enables organizations
to enforce their security policies
without the constraints of back hauling traffic
to a central location,
which in turn reduces latency
and improves your user's overall experience.
So remember, the Secure Access Secure Edge, or SASE
and the Security Service Edge, or SSE frameworks
are network security architectures
that blend traditional network services
with comprehensive security functions.
The Secure Access Secure Edge framework
is used to consolidate numerous wide area networking
and security functions into a single cloud native service
to ensure that secure and seamless access
for our end users can be achieved,
regardless of their actual physical location.
The Security Service Edge framework is a key subset
of the Secure Access Secure Edge model
that's focused exclusively
on the security services necessary
to protect access between our users,
devices and the cloud.
While SASE combines comprehensive WAN
and security services,
the Security Service Edge really does focus only on security
and determining what is required to guard the data
and interactions inside of a cloud centric world.
As we continue to shift our enterprises
and our corporate networks
towards more distributed networks,
these models and frameworks
are going to continue to play
an increasingly vital role
in ensuring that security is not just an afterthought,
but it's a foundational component
inside of our network architectures.