Hybrid cloud systems and the adoption of edge computing among enterprises have solved a host of modern problems, from real-time application latency needs to regulatory data privacy needs in a global economy. But the intersection of on-premise, cloud and edge computing has created challenges ensure different systems under one roof.
Secure Access Service Edge (SASE) addresses this fragmentation. It integrates software-defined networking, threat prevention, access control and application security into a unified cloud-delivered platform accessed through a single management interface.
SASE’s operational foundation is based on globally distributed points of presence (PoPs), positioned to place network security and enforcement as close as possible to users and data sources. This distributed framework, often managed by SASE vendors, eliminates the operational burden of provisioning and maintaining complex network infrastructures, while ensuring low-latency access to cloud applications through direct routing to the cloud.
Convergence begins with SD-WAN (Software Defined Wide Area Network), which intelligently routes traffic across multiple transport links, including MPLS (Multiprotocol Label Switching), broadband, LTE and 5G. Rather than relying on expensive static MPLS circuits, SD-WAN dynamically selects optimal routes based on application requirements, link quality and business priorities. This intelligent routing ensures that branch offices, remote workers, and edge devices get consistent application performance without capacity constraints.
“Software-defined networking is where we see most customers starting with their SASE implementations,” says Ben Radcliff, vice president of cybersecurity and managed security services at Ensono.
The second phase for most organizations is to layer security on top of SD-WAN, with zero trust as the prevailing theme, adds Dave Shackleford, founder and CEO of Voodoo Security.
“Over time, SASE converges the security web gateway and provides the firewall as a service in the cloud fabric, while the standalone proxies disappear as everyone passes through this system,” he explains.
SASE integrates critical functions
Essentially, a SASE architecture integrates five critical security functions that previously required separate devices and licenses:
-
Firewall-as-a-Service (FWaaS) delivers next-generation firewall capabilities (stateful inflation, application control, intrusion prevention, and threat intelligence) through a cloud platform, eliminating the need to deploy hardware firewalls at each location.
-
Secure Web Gateway (SWG) protects users accessing Internet resources by filtering malicious websites, inspecting web traffic, and enforcing acceptable usage policies regardless of the user’s location, with direct Internet access from remote sites, bypassing inefficient traffic that is concentrated through central data centers.
-
Cloud Access Security Broker (CASB) provides visibility and control over SaaS, detects unauthorized cloud services, and enforces data loss prevention policies to prevent sensitive information from leaking into unauthorized repositories.
-
Zero Trust Network Access (ZTNA) replaces traditional VPNs with identity-based application-level access controls that continuously verify users.
Experts agree that the unified policy engine represents a key advantage over legacy security architectures. Security administrators can define policies once in the SASE console and apply them consistently across all edge devices, cloud workloads, and remote users, rather than maintaining separate policy structures across firewalls, VPN devices, web proxies, and cloud security tools.
These policies can incorporate contextual data, including user identity, device posture, geographic location, behavioral patterns, and risk scores, to apply real-time adaptive controls. As organizational requirements change, policy updates automatically propagate across the platform, eliminating the need for manual reconfiguration at individual sites.
“This centralization eliminates policy inconsistencies associated with multi-vendor security stacks and could even reduce the staffing required,” says John Grady, principal analyst at Omdia.
SASE eliminates VPN bottlenecks for remote workers and secures the Internet of Things. In IoT environments, SASE enforces zero-trust policies at the device level, promptly identifying and mitigating risks through granular access controls, while protecting disparate endpoints, often with limited resources and without integrated security features.
Operational simplification also extends to infrastructure deployment and provisioning. New branches can connect to SASE platforms in hours using lightweight edge devices, rather than the weeks it takes to provision and set up hardware. Organizations can also add thousands of edge nodes without commensurate increases in personnel or infrastructure costs; the SASE provider manages scalability, upgrades, and availability across the distributed infrastructure.
Unified logging and analytics also provide end-to-end visibility into users, devices, applications and threats. This enables faster anomaly detection, deeper investigation of incidents, and more precise threat response than correlating logs across multiple disparate tools.
Challenges in replacing legacy security
This architectural shift requires organizations to fundamentally rethink security governance. It means “moving from device-centric controls to identity- and application-centric policies, retraining IT teams to manage cloud-native services rather than managing equipment, and establishing new relationships with cloud providers who become responsible for securing the infrastructure that organizations previously directly controlled,” Grady says.
Regardless of how effective SASE is at protecting the edge, there is the practical reality that security teams must replace entrenched legacy infrastructure. This transformation can create significant organizational, technical and operational challenges that organizations often underestimate. Many scenarios often require the continued use of legacy firewalls and VPN infrastructures, such as on-premises databases that are accessed only by internal applications, legacy systems that cannot connect via SASE, or relationships with third-party vendors that require direct network access.
“This is a large undertaking, and only a small percentage of enterprises are well on their way to SASE maturity, let alone fully mature SASE capabilities,” Grady said.
Rather than simply translating legacy rules into SASE syntax, organizations must redesign policies from first principles, applying principles of least privilege so that users and devices receive only the access necessary for their specific roles and applications. This redesign process requires understanding the business logic behind each rule, ensuring that redesigned policies do not break legitimate business workflows, and performing extensive testing before deployment to production.
The transition period, which often extends from 6 to 18 months or more, requires maintaining security in both legacy and SASE-protected environments simultaneously. During this phase, organizations must ensure that users, devices, and applications cannot bypass SASE controls by routing traffic through remaining legacy infrastructure. In the final part of this series, we will discuss the six steps to successfully execute this transformation.
