SASE vs. SSE: Explaining the differences
Most security professionals are familiar with secure access service edge, but now, there's a new tool for administrators to consider: security service edge.
Secure access service edge is a concept familiar to most security professionals. The newer security service edge might not be, however.
One of the major elements of SASE is software-defined networking (SDN), with an emphasis on brokered connectivity for branch offices and remote locations through a cloud fabric. While SSE still includes some elements of network access and brokered connectivity, SSE is geared more to end users than SASE.
Let's take a deeper look at each and explore how to choose between the two.
What is SASE?
Coined in 2019 by Gartner, SASE represents the convergence of networking service brokering, identity service brokering and security as a service within a single unified fabric. SASE helps make security more effective by reducing the steps it takes to harness the traditional approaches companies rely on to protect both edge environments and standalone users. It does this by creating a single brokering fabric that envelopes all the disparate networking services an organization is using and puts them under a single point of control.
Core elements of SASE include the following:
- Secure web gateway (SWG) controls. These include web content filtering, site reputation and threat intelligence.
- Zero-trust network access (ZTNA) controls. These controls authenticate workloads and end-user systems. They provide behavioral analysis of access models and connectivity that can modify access controls dynamically based on specific scenarios and interactions.
- Identity and access management. IAM integration and role-based policies provide federation, single sign-on, MFA and more.
- Firewalls. SASE tools offer core network firewalling and access controls to prevent intrusions.
- SaaS security controls. These controls, similar to traditional cloud access security broker (CASB) tools, enforce user access security policies.
- Software-defined WAN connectivity options. SD-WAN enables locations, including cloud service environments, branch locations, traditional data centers and end users, to interconnect.
What is SSE?
In 2021, Gartner introduced SSE, which focuses more on security capabilities and less on network connectivity and infrastructure. SSE is like SASE but doesn't include SD-WAN capabilities. This favors traditional ZTNA, CASB and SWG providers with strong cloud brokering options that don't come from networking backgrounds.
A strong group of current SSE offerings originated in CASB, ZTNA and SWG products. In some cases, some providers have acquired or expanded into SD-WAN, which could lead to a transition from SSE to SASE in some cases.
The core aspects of SSE include ZTNA, SWG, CASB and network traffic control, also known as firewall as a service (FWaaS).
Zero-trust network access
ZTNA focuses primarily on how end users access cloud and online services and data. It involves policies applied to evaluate who is accessing resources, from what system and whether any behavioral aspects of access are suspicious or malicious.
Key elements of ZTNA include the following:
- Strong authentication and authorization of endpoint systems and user accounts.
- Adaptive access policies that evaluate group membership and privileges, access behaviors and known malicious or suspicious indicators.
- Browser isolation and sandboxing to prevent malware infection and other browser-based threats.
Secure web gateway
SWG functionality includes content filtering and URL-based access controls, as well as some DNS monitoring and browser security controls. Most SWG platforms include content monitoring and data loss prevention policy tools as well. Leading options also offer remote browser isolation tools and capabilities that fortify web browsers with a sandbox designed to protect users when visiting designated sites.
Cloud access security broker
A CASB probes deeply into cloud services -- primarily SaaS but also applications and services in PaaS and IaaS environments -- to examine API calls and behaviors for unusual activity.
Many cloud applications are complex web services with vast arrays of API calls. CASB services permit a much deeper analysis of specific interactions within the context of a single cloud application.
Network traffic control
Another capability some vendors tout is network traffic control, or FWaaS. FWaaS replaces traditional next-gen firewall controls with a cloud-based model.
SSE can be a valuable feature here to control things such as remote access protocols -- for example, SSH and Remote Desktop Protocol -- and other malicious nonweb traffic.
SASE vs. SSE: Use SASE for comprehensive coverage
When examining SASE vs. SSE, consider SSE a subset of SASE -- encompassing most of the same security control capabilities other than network bandwidth control and WAN optimization.
SASE is a more appropriate brokering option for enterprises that need comprehensive cloud-based connectivity and a security policies application that covers both end users and entire locations moving away from a hub-and-spoke model of network connectivity. For remote users, SSE offers the same security options without layering on SD-WAN and SDN network traffic management options that are largely superfluous.
Most organizations today need what SSE provides: a suite of controls that can shield a remote workforce from malicious activities through the deployment of a zero-trust model governing access control and monitoring, browser and cloud services security, and data protection. Many providers offer both SASE and SSE, with SSE available through a licensing model that enables an organization to upgrade to SASE if appropriate.
Dave Shackleford is founder and principal consultant with Voodoo Security; SANS analyst, instructor and course author; and GIAC technical director.
