SSE or SASE: which strategy to adopt?

OP-ED · 11 OCTOBER 2022

By Olivier Péricat · Lire en français

Organisations are becoming a little more hybrid every day. The explosion of mobility and Cloud usage is leading IT teams to reconsider the resources needed to deliver fast and secure services.

They face two challenges:

Guaranteeing quality of service to employees who use their own means of connection
Controlling the attack surface created by all the resources connected directly to the Internet

The daily cyberattacks affecting our companies and public services show how much ground remains to be covered.

Yet simple approaches exist to meet these challenges.

They were conceptualised by Gartner with the SASE (2019) and SSE (2021) models.

SSE for security

The SSE (Security Service Edge) model provides an answer for protecting all assets.

It delivers all protection mechanisms (firewall, web filtering, IDS, IPS, anti-malware, CASB, DLP, RBI, etc.) through a platform running in the Cloud and based on an identity-driven approach (Zero Trust Network Access).

Maintenance and updates are carried out by the provider and require no operations from IT teams.

With this type of platform, all the company's resources are protected against the Internet over the long term.

SASE to add transport and performance

The SASE model complements the SSE model by adding access and transport. In addition to SSE features, the SASE model integrates all SD-WAN access, routing and secure transport mechanisms between the organisation's sites, as well as all performance optimisation mechanisms: traffic prioritisation and classes of service.

As with the SSE model, maintenance and updates are carried out by the provider and require no operations from IT teams.

With this type of platform, all the company's resources, whether on site or on the move, are protected and access internal and external applications with performance guarantees.

SSE or SASE?

For an organisation with a single site, the SSE model provides a suitable answer to the security challenges of resources on site and on the move.

The SASE model is particularly well suited as soon as the company has several sites that need to communicate with each other.

It replaces traditional WAN infrastructure such as MPLS or IP VPN while providing performance guarantees similar to MPLS.

"Fully implementing the SASE model allows companies to do away with all their WAN network and perimeter security infrastructure. It is the ultimate target of the transformation, reducing costs, complexity and the operational burden on IT teams as much as possible. However, WAN contracts, maintenance contracts and the depreciation of existing equipment rarely coincide. That is when setting up the first SSE building block makes sense, to immediately bring the right level of protection to the company's resources. The move to the SASE model then takes place in a second phase, when the WAN contract expires." says Olivier PERICAT.

The choice between SSE and SASE therefore depends on the type of company and on an analysis of its existing financial and contractual situation.

"There are far more SSE players than SASE players. Clients must choose a platform able to evolve with them. A multi-site organisation starting with a project to secure its Internet traffic will therefore benefit from choosing an SSE platform able to evolve natively towards SASE. Otherwise, it will have to either abandon it or make it interoperate with an SD-WAN access product. This second option will lead to higher costs, technical complexity, lower performance, multiple management consoles and fragmented visibility." he explains.

An example: Cato Networks

Founded in 2015 with the vision of converging transport and security functions in the Cloud, Cato Networks inspired the conceptualisation of the SASE model.

With a global backbone of around 80 points of presence, the Cato Cloud transports and secures several hundred thousand sites and several million mobile users around the world.

To support organisations as they change, Cato Networks created an SSE360 offering as the first step in a transformation towards SASE.

With SSE360, an organisation's sites connect to the Cato Cloud through IPsec tunnels initiated from their own security infrastructure. Mobile users use the Cato VPN client to connect to the nearest Cato point of presence.

All resources are then protected by the full set of security features (firewall, web filtering, IDS, IPS, anti-malware, CASB, DLP, RBI, etc.), and IT teams have a unified management tool offering a complete view of traffic and identity-based access management (Zero Trust Network Access).

Later on, it is very simple to move gradually to SASE by deploying Cato gateways, physical on sites and virtual on Azure or AWS Cloud tenants, to benefit from advanced SD-WAN transport features.

The advanced protection features delivered by Cato Networks SASE and SSE360 include Cloud application control (CASB) and data control (DLP).

More than 97% of the Cloud applications used in companies are unknown to IT teams. This represents nearly a thousand applications for a mid-sized company and concerns 80% of users on average.

In addition, 40% of organisations have experienced a data leak in the last 12 months.

These two building blocks are becoming essential.

CASB (Cloud Access Security Broker) is characterised by two key elements:

Visibility of SaaS / Cloud applications: knowing all the Cloud and SaaS applications consumed on the network, whether approved or not (Shadow IT discovery), with an associated risk score.
Filtering of in-app activities: once full visibility is achieved, usage rules can be applied to the various Cloud applications, allowing or blocking activities within them, such as restricting logins to certain apps or sending and receiving files.

DLP (Data Loss Prevention) is generally a heavy and complex mechanism to implement. Cato SASE and SSE360 considerably simplify the approach, since the Cato Cloud already has complete visibility of all traffic crossing the network. All that is needed is to select the type of data to protect (personal data, PCI DSS, health, finance, etc.) and apply the appropriate rules. A concrete scenario: "prevent payment card numbers or banking information from being shared on social networks".

Adding CASB or DLP requires no additional equipment. All traffic is decrypted once at the nearest Cato point of presence to apply all security processing, providing unified protection and visibility.

💡 To discover Cato Networks #SSE360, nothing beats a demo!

👀 Save the date 📅 👇

Book a demo →

💡 To find out more about Cato Networks

Learn more →