What is SASE?

SASE stands for Secure Access Service Edge. It is a cloud-based network infrastructure model built around a combination of network and security services. The goal is to ensure your organization's devices and users can securely access critical systems and applications at any time from anywhere. Gartner predicts that 40% of enterprises will have established a strategy around SASE by 2024, up from only 1% in 2018. That estimate may end up being conservative, since a vast majority of this shift is being driven by an increase in cloud consumption, the adoption of multi-cloud environments, as well as the acceleration of hybrid/remote workers since the start of the pandemic.

SD-WAN plays a primary role in a SASE model. It offers an incredible return on investment (ROI) and excellent customer experience when it comes to consuming cloud applications. As traffic patterns move away from the private data center and into cloud data centers and Software as a Service (SaaS) platforms, the edge becomes more complex and requires a solution like SD-WAN to intelligently route traffic in the right direction. This helps hybrid and remote workers access the same services and applications as on-premises employees, creating a seamless experience no matter the location.

What has driven the recent surge in popularity of SASE?

A lot of people think that SASE is just SD-WAN because you are optimizing your circuits, optimizing your connectivity, developing a next-generation network, and shifting away from legacy technologies such as DMVPN, MPLS, and hard-wired internet access. But beyond those things, SASE includes a number of security elements and other smart features. When the pandemic hit and the workforce suddenly went remote, many organizations had to open up VPN technologies, extend AnyConnect licenses, and find new ways to keep users safe while they were scattered all over the place. In some cases businesses had a next-generation firewall that only protected on-premises workers, so they needed to find a way to extend that coverage. Identity and access, multi-factor authentication, and URL filtering have all received a major boost these last couple of years. Technologies such as Cisco Umbrella, SD-WAN, and Viptela have also been migrated to the cloud so they're accessible no matter where employees are located, really driving the conversation and rapid adoption of SASE today.

What are some Cisco offerings related to SASE?

Cisco’s SASE model breaks things down into three pieces: networking, security, and observability. In networking, they are the largest SD-WAN provider on the market, with solutions that include Meraki and Viptela. It makes them a leader in the Gartner Magic Quadrant. In security they've taken Umbrella, which was originally just for DNS security, and developed it into a full security stack in the cloud. That has been incredibly successful for them as well. Cisco's somewhat recent acquisition of ThousandEyes helped put that last piece of observability in place. If you have multiple circuits going to multiple locations, ThousandEyes provides visibility to help you determine which circuit is best for which application to improve both the speed and quality of user experiences.

While the pandemic and remote work has certainly escalated the adoption of SASE, so have more organizations moving large portions of their infrastructure into the cloud along with SaaS solutions. It makes no sense to have a user VPN into your network and then hairpin straight back out into a SaaS solution. While most SaaS applications have built-in security, that's certainly not their primary focus, so organizations are smart to place their security stack in front of all that to ensure the user remains protected no matter if they're on-premises, at home, or in a cafe somewhere. All that is to say Cisco feels very well positioned in the SASE space, and Gartner agrees.

What is the Fortis SASE Workshop, and what does it include?

The Fortis SASE Workshop is available free of charge, and only takes about 90 minutes to complete. Members of the Fortis by Sentinel team sit down with your organization and begin by gathering information about your IT environment. Once we understand what technology and systems comprise your environment, the goal is to figure out how to leverage cloud services to improve application performance, user performance, and overall security. While cost savings may play a large role in determining what you're ultimately able to do, it's also essential to understand the many benefits and ROI that can be achieved through committing to a SASE model.

As an example, not too long ago a large internet provider had a system-wide outage. Certain Fortis customers that had a true SASE model running with Cisco Viptela and SaaS-based applications like Duo and Salesforce didn't experience the outage at all. We were monitoring the health of their SaaS-based applications and immediately re-routed them to a different service provider once it became clear they were unreachable through the carrier's primary link. Customers still using legacy technologies such as DMVPN were left without service for hours, costing time, money, and productivity. So not only can SASE lower costs, but it can really improve the user experience as well.

When it comes to security posture, a lot of organizations will just check off boxes. They'll deploy a next-generation firewall, some Cisco Adaptive Security Appliance (ASA) software, or Firepower Threat Defense (FTD) and think these solutions will handle their needs and keep their environment safe. Some organizations refuse to use tools like SSL decryption out of concern for how it would impact the performance of their current, on-premises firewall. But if you can move to an expandable cloud-based firewall or Secure Internet Gateway (SIG), you can apply SSL decryption rules on that traffic in the cloud without the need for a much bigger on-premises firewall for your users. The same rules apply to every user no matter their location.

So the SASE Workshop details how Fortis can help improve your security, along with other deliverables and outcomes that can benefit your organization. You may need to look at your monthly costs and do an ROI evaluation to explore the possibility of implementing dual divergent internet circuits and SD-WAN. Typically it takes organizations an average of 4-6 months to achieve a complete ROI on that, where legacy circuits such as MPLS or direct T1s point-to-point are converted over to direct internet fiber circuits with Viptela as an overlay. We can conduct these kinds of evaluations as part of the SASE Workshop as well.

One other key part the Fortis team can cover in the SASE Workshop is: Where do I begin? There are so many different components to consider when adopting a SASE model, and it all depends on the strategy you develop in accordance with a timeline. For example, you may want to have a full SASE solution ready to go in three years, but right now your first priority might be to upgrade your routers. If you're not ready for cloud security right away, focus on making sure any new routers purchased can actually work within a SASE environment. Perhaps you're good on the edge, but need to upgrade your firewalls or centralize your security. If the vision is to get to the SASE model, you need to determine where you can take a step in the right direction and then make sure you're continually on the path established by your roadmap. The Fortis SASE Workshop can help figure out where you are, what investments you've made, what you're ready for, what the next step might be, what some short-term goals are that you can set, and then we'll work with you to build a plan and make it a reality.

If you’re interested in learning more about SASE and/or the Fortis SASE Workshop, please contact us or reach out to your Fortis by Sentinel account manager.