Will Your Organization Benefit from Security Services Edge (SSE)?

We want to keep things as simple as possible in this post about Security Services Edge (SSE); that is, what is SSE, what are the components, and what SSE is not. Fundamentally, SSE provides the security service elements of a comprehensive SASE strategy. So, to be clear, SSE is a subset or component of a SASE solution or strategy. 

Again, circling back, SSE delivers access control, threat protection, data security, security monitoring, and acceptable use control functionality into a single cloud-delivered solution. Further, when SSE is combined with SD-WAN, it forms a comprehensive SASE platform, providing monitoring and policy enforcement with integrated network controls and application APIs augmented by endpoint-based controls.

Ok, now you have a fundamental understanding of what SSE is and how it is integrated into an IT security environment, now let’s take a short step back and discuss where SSE came from and the components that often make up an SSE solution.

 

 

Security Services Edge (SSE) is an emerging cybersecurity concept Gartner introduced in its 2021 Roadmap for SASE Convergence report. According to Gartner, “SSE is a collection of integrated, cloud-centric security capabilities that facilitates safe access to websites, software-as-a-service (SaaS) applications, and private applications. Specifically, SSE-related security capabilities include:

• Zero Trust Network Access (ZTNA)
• Cloud secure web gateway (SWG)
• Cloud access security broker (CASB)
• Firewall-as-a-service (FWaaS)

Don’t worry; we’ll discuss the components of an SSE solution just a bit later. The point we want to convey first is that a comprehensive SSE solution provides organizations with the complete set of security technologies they need to provide employees, trusted partners, and contractors secure remote access to applications, data, tools, and other corporate resources – without having them connect directly to the corporate network. Further, a full SSE solution allows security teams to monitor and track behavior more effectively once users access the network. As the remote workforce grew starting with the pandemic, securing remote and mobile users, and the data and apps they access became critical – SSE solutions provide the tools to achieve an improved security posture.

 

What is Security Services Edge, and Where Did the Concept Come From?

In the last section, we quoted Gartner concerning the definition of SSE, and we bolded their term concept to describe SSE. Let’s dig into why it is a concept and not a well-defined “solution.” To do that we’ll take another short step back and discuss SASE. Secure Access Service Edge (SASE) – is a cloud architecture model that bundles network and Security-as-a-Service functions together and delivers them as a single cloud service. SASE allows organizations to unify their network and security tools in a single management console.

 SASE is another concept that was introduced and defined by Gartner in 2019. They define SASE as “the convergence of software-defined wide area networking or SD-WAN, and network security services like CASB, FwaaS, and ZTNA into a single, cloud-delivered service model.”

In plain language, SSE solutions provide secure connectivity to users through cloud-based services, eliminating the need for employees to connect directly to the corporate network for cloud-based services and applications. An enormous benefit of SSE is to eliminate the need to expose an organization’s IT infrastructure or applications needlessly. Rather, an SSE solution allows users to connect securely to applications across the internet.

 

Secure Access Service Edge (SASE) vs. Security Service Edge (SSE)

Ok, because there is so much confusion between SSE and SASE let’s take just a moment to compare and contrast the two Gartner concepts. In the SASE framework, network and security services should be consumed through a unified, cloud-delivered approach. The networking and security aspects of SASE solutions will focus on improving the user-to-cloud-app experience while inherently reducing costs and complexity.

You can look at a SASE platform in two parts. The SSE piece focuses on unifying all security services, including SWG, CASB, and ZTNA. The second piece, the WAN part, focuses on networking services, including software-defined wide area networking (SD-WAN), WAN optimization, quality of service (QoS), and other means of improving routing to cloud apps.

 

What Security Challenges Does SSE Solve?

Increasingly, organizations are adopting software and infrastructure as a service (SaaS, IaaS) solutions and other cloud apps. Because of this migration to the cloud, the company’s critical information and data becomes more distributed outside of the traditional on-prem data centers. Further, and most importantly for SSE, the transition of users to mobile and remote devices, connecting from diverse locations, over a variety of connections, to Microsoft 365, Google Docs and other cloud apps has spured the need for the SSE concept or solution.

Traditional Network Security Issues with Remote Users

Securing cloud apps and mobile users is difficult with traditional network security approaches because:

• Because network technology is part of an on-prem data center, they are not able to follow connections between users and cloud apps. Thus, log data that may expose nefarious users or activity is often masked.
• VPNs are notoriously exposed to even the simplest attack due to a lack of patching.
• Relaying user traffic to a data center via traditional VPN slows connections, user activity, download speeds and data movement.
• Hardware maintenance of servers and storage, as an example, make typical, on-prem data center approaches expensive.

Finally, as we’ve discussed so often in previous blog posts, typical layered security defense concepts or solutions are overwhelmingly complex for security teams. While firewalls, IDS/IPS, Endpoint, Anti-virus and other technology play critical roles in defending an organization from attack, they also inherently leave gaps that are often easily exploited by today’s more sophisticated malware.

 

Advantages of SSE Over Traditional Network Security

Delivered from a unified cloud-centric platform, SSE enables organizations to break free from the challenges of traditional network security. SSE provides four primary advantages:

1. Fewer Security Gaps Leading to Better Security Posture

SSE improves visibility across remote users and data, regardless of location, connection or channels accessed. Also, SSE automatically patches software updates across applications and most importantly without the typical lag time of manual IT administration.

In addition, as we suggested earlier, because security is now delivered through the cloud, the behavior of users is visible no matter the connection, location, or activity. This will be an enormous benefit as security teams deal with anomalous traffic on their networks that often are tell-tale signs of malicious activity.

2. Consolidation Advantages

According to Gartner among others, “SSE can deliver many key security services—SWG, CASB, ZTNA, cloud firewall (FWaaS), cloud sandbox, cloud data loss prevention (DLP), cloud security posture management (CSPM), and cloud browser isolation (CBI)—all in one platform.” In addition, it is not an all-or-none proposition, with SSE, organizations can add technologies to the platform at their own pace. One technology is not dependent on another like many layered, on-prem security solutions.

3. Zero Trust Access – click here to read our blog post titled “The 5 Basic Steps to Building a Zero Trust Network

The Zero Trust model is the response to the realization that the perimeter security approach hasn’t been practical because many data breaches happened. After all, attackers could move through internal systems without the risk of being uncovered and stopped once they got past the corporate firewalls. 

SSE platforms (along with SASE) should enable least-privileged access from users to the cloud or private apps with a fundamental zero trust policy based on four factors: user, device, application, and content. Applications are not exposed to the internet and thus can’t be discovered, reducing the attack surface, increasing security posture, and further minimizing business risk.

4. User Experience

Continuing to leverage Gartner’s idea of the SSE concept, “SSE must be fully distributed across a global footprint of data centers. The best SSE architectures are purpose-built for inspection in every data center instead of vendors hosting their SSE platforms in IaaS infrastructures.”

Distributed architecture improves performance and reduces latency because content inspection—including TLS/SSL decryption and inspection—occurs where the end user connects to the SSE cloud. Combined with peering across the SSE platform, this gives your mobile users the best experience. They no longer need to use slow VPNs, and access to apps in public and private clouds is fast and seamless.

 

What are the Top SSE Use Cases for Cyber Security?

1. Secure Access to Cloud Services and Web Usage

As we suggested when we discussed the value of Zero Trust, enforcing policy control over user access to the internet, web, and cloud applications is one of the primary use cases for SSE. SSE policy control helps mitigate risk as end users access content on- and off-network. Enforcing corporate internet and access control policies for compliance is also a key driver for this use case across IaaS, PaaS, and SaaS.

Another key capability is cloud security posture management (CSPM), which protects your organization from risky misconfigurations that can lead to breaches.

2. Detect and Mitigate Threats

Detecting threats and preventing successful attacks across the internet, web, and cloud services are critical drivers for adopting SSE. With the shift to remote work and mobile access to the corporate network, end users are accessing content across any connection or device.

An SSE platform must have advanced threat prevention capabilities, including a cloud firewall (FWaaS), cloud sandbox, malware detection, and cloud browser isolation. CASBs enable the inspection of data within SaaS apps and can identify and quarantine existing malware before it inflicts damage. Adaptive access control, whereby an end user’s device posture is determined, and access is adjusted accordingly, is also a key component.

3. Connect and Secure Remote Workers

The modern remote workforce needs remote access to cloud services and private applications without the inherent risks and slow speeds of VPN. Thus, enabling access to applications, data, and content without enabling access to the network is a critical piece of zero trust access because it eliminates the security risks of giving users direct access to the corporate network.

Providing secure access to private and cloud apps without needing to open firewall ACLs or expose apps to the internet is critical. SSE platforms should enable native inside-out app connectivity, keeping apps “dark” to the internet. A ZTNA approach should also offer scalability across a global network of access points, giving all your users the fastest experience regardless of connectivity demands.

4. Identify and Protect Sensitive Data

SSE enables you to find and control sensitive data no matter where it resides. By unifying key data protection technologies, an SSE platform provides better visibility and greater simplicity across all data channels. Cloud DLP enables sensitive data or PII to be easily found, classified, and secured to support Payment Card Industry (PCI) standards and other compliance policies. SSE also simplifies data protection, as you can create DLP policies just once and apply them across inline traffic and data at rest in cloud apps via CASBs.

 

Conclusion 

As we conclude this post on SSE solutions, let’s reevaluate what we discussed earlier: “SSE solutions provide secure connectivity to users through cloud-based services, eliminating the need for employees to connect directly to the corporate network for cloud-based services and applications. An enormous benefit of SSE is to eliminate the need to expose an organization’s IT infrastructure or applications needlessly. Rather, an SSE solution allows users to connect securely to applications across the internet.”

SSE combines cloud-centric security technologies such as zero-trust network access (ZTNA), secure web gateway (SWG), cloud access security broker (CASB), and firewall as a service (FWaaS) to provide secure remote access to cloud and enterprise resources.

Finally, a comprehensive SSE solution gives provides organizations with the complete set of security technologies they need to provide secure remote access to applications, data, tools, and other corporate resources to employees, trusted partners, and contractors, as well as monitor and track behavior once users are on the network.

 

To Learn More About How to Defend Against Malware Attacks or If You Have Been Attacked, Please Call Us – as Always; We Are Happy to Help – 1 (888) 982-0678.

You Can Also Fill Out Our Contact Us Form Here to Talk with a Security Specialist – https://secureops.com/contact-us/