SASE – ENABLING AND
PROTECTING MODERN
BUSINESS CONNECTIVITY
What is SASE? Why is it important? Where should
you start? And what strategic decisions should you
consider during the early phases of adoption?

WHAT IS SASE?
(ZTNA) is an essential part of the SASE offering. To further enrich
the SASE security stack, additional security functions including
malware protection, Web-Application-Firewall/Web Application API
Protection-as-a-service, DDOS prevention, Data Loss Prevention(DLP) and User-Entity-Behaviour-Analytics (UEBA) are alsoavailable dependant on the vendor portfolio.

The acronym was first introduced by Gartner in 2019 and stands
for ‘Secure Access Services Edge’. With a combination of networkand security components that are bound together as a single
architecture, SASE can deliver the secure access requirements formodern enterprise.
The networking components of SASE encompass a number ofareas, including; SD-WAN, content-delivery networks, networkas-a-service and bandwidth aggregation. To offer an easier
to consume and more complete solution, selected networking
equipment vendors have entered into partnerships with carriers
to integrate their products and deliver off-the-shelf SASEofferings.

SASE extends beyond a pure architecture to ensure that solutionsaligned to the SASE design principles consider the following
activities when facilitating and securing access:• The identity of the entity connecting•	Context (e.g. type, health and behaviour of the device,sensitivity of the resources being accessed)• Security and compliance policies• An ongoing assessment of risk during each session.

The security elements of the SASE architecture rely on network
security functions including; VPN, firewall (as-a-service), Secure
Web Gateway (SWG), Remote Browser Isolation (RBI), Cloud-Access
Security Brokers (CASB) and DNS security. To enable secureaccess for users, devices and things, Zero Trust Network access

INFRASTRUCTURE SECURITY

All these capabilities should be offered together as a SASE service
underpinned by a single architecture.

WEB SECURITY(MOBILE) USER SECURITY
ZERO TRUST NETWORK ACCESS

Malware Protection​

Cloud | On-Premise​ | Hybrid​

Architecture & Management​

Web Application Firewall(WAF)​
IDS/IPS service​

Cloud Access Security
Broker (CASB)​Firewall cloud service(FWaaS)​

Remote Browser Isolation(RBI)​ZTNA​Continuous Inspection​
Zero Trust​

DDoS Protection​

Firewall edge service​

Secure Web Gateway (SWG)​
Functional capabilities​

ZTNA​
MFA & Identity​

Data Loss Prevention (DLP)​

VPN service​(Site-to-Site)​

DNS Security​

ZTNA/VPN​
Endpoint/Service Initiated​

User Entity Behaviour
Analytics (UEBA)​Web App. API Protection(WAAPaaS)​

SECURITY FUNCTIONS

SD-WAN service​
Application-based path selection​

SD-WAN service​
Performance/WAN optimisation​

Rollout Automation​
Zero Touch provisioning​

Carrier/CDN functions​

Device connectivity WAN​
(ETH, Mobile 4G/5G)​

Network as a service​
LAN/WLAN​NETWORK FUNCTIONSWHY IS IT IMPORTANT?
Secure Access Service Edge (SASE) describes the move to unified
network and security controls operating in the cloud. It’s a shift
away from the traditional method of routing network traffic
through the data center and managing security at the perimeterof an organisation’s network.

of how to design, build and manage the network and security
demands of decentralised traffic without routing it through acentralised data center.
With greater demand to access applications and data in the cloudfrom outside the traditional perimeter, traditional methods ofrouting network traffic have resulted in significant congestion andlatency in the data center, bringing about a poor user experienceand stifling instiutional agility. This has been highlighted by thefast transition towards hybrid working catalysed by the ongoing
COVID-19 pandemic.

SASE differs by building on SD-WAN connectivity and concepts suchas Zero-Trust networking. This delivers a single platform offering
network security, web security and mobile user security alongside
many other security control functions that are network-centric
in nature. Driven by the growth of cloud adoption and increasing
mobility of today’s workforce, SASE is an answer to the problem

SERVICESINTERNETAPPSBRANCH□□□□□□□□□□□□□□□□□□

BRANCH□□□□□□

BRANCH

BRANCHHEADQUARTERS□□□□□□□□□

DEDICATED BROADBAND

BRANCHSaaS

The key concept behind SASE is to distributecritical network and security functions fromthe cloud, closer to where the user andapplications now are, connecting users via
nearby Points of Presence (PoP) instead ofrouting them back to the centralised datacenter. In doing so, a SASE model will alleviate
the burden of increasing data flowing throughthe data center, enable a more flexible
network, speed up network response times
and allow companies to apply Principles ofLeast Privilege such as Zero Trust.
Taking this approach combines andunifies policy management which enables
companies to quickly and efficiently secure
traffic regardless of its origins or the locationof corporate resources, making it an attractive
option for many organisations.

BRANCH□□□

Microsoft 365, etc

Public CloudIaaS/PaaS
AWS, Azure etc

SASE
SD-WAN

SD-WAN□□□□□□□□□

BRANCH
Network as a ServiceLAN/WLAN

REMOTE WORKER
HEAD OFFICETODAY’S VIEW OF THE SASE KEY
STRATEGIC MARKET PLAYERS
Although Gartner defined SASE back in 2019, we still see it as anevolving solution landscape. Many providers can claim to have afull SASE product set, but in our view, there is no single vendor thatoffers all of the granular components needed in each product tomeet the complete requirements of an effective SASE solution.
Consequently, we see three types of vendors offering SASE
capability, each with their own benefits and drawbacks.
PURE PLAY SASE VENDORS
These vendors, with no historical infrastructure centric network orsecurity legacy, arrived in the market as software only, born-inthe-cloud network and security vendors focused only on SASE stylesolutions. This makes it easier for them to add new features andfunctions in a cost-effective manner.
NETWORK AND SECURITY VENDORS
Vendors who have historically led the network and security
infrastructure software and hardware market are evolving theirlegacy platforms by bundling current products, undertaking
strategic acquisitions, or evolving hardware offerings to software
ones and are taking the results to market as SASE solutions.

SaaS

Whilst these vendors have a great depth of experience andimpressive solution portfolios, there is still progress to be madeto complete integrations as there are sometimes key capabilities
still missing.
PLATFORM SECURITY SPECIALIST
Organisations that have been integrating network and/or security
into their existing technology platforms are now adding additional
SASE components as well. Whilst these vendors may evolve to
become leading players in the future given the scale of their base,they still need to develop further capability to offer a complete
solution. One platform vendor, for example, may have essential
elements of the SASE framework that few of the others have,including identity and access management controls, but lacks thenetwork infrastructure components such as SD-WAN.
Finally, it is also worth noting that the SASE marketplace is afast evolving one, and in our view a number of security software
vendors with ‘point functions’ are likely to become acquisition
targets for use as the base platform to build and launch new
SASE solutions.

IaaS

Private Cloud/On Prem DC

Telco & CSPs

How different vendors map to SASE requirements

PLANPlatform Security Specialists

Aggregator & Platforms

RUNPure PlaySASEVendors

Security Infrastructure
Vendors

BUILD

SD-WAN/SASE Providers

SASE BENEFITSThe promised benefits of a SASE platform are extensive and support the move to cloud-based enterprise security combining
network and security functions. Key benefits include:•	The ability to easily scale networking and security
capabilities;• Optimal security for applications that can live anywhere;•	Centralised, dynamic, role-based policies that streamline
operations;•	The ability to consolidate previously stand-aloneplatforms;•	The potential to simplify complex multivendor security
landscapes and achieve cost reduction via consolidation,and the removal of excess security software andinfrastructure platforms;•	SASE environments are mostly cloud native by design
which increases flexibility and reduces the operational
cost of supporting large scale infrastructure centric
security estates.

SASE CAUTIONSSASE is still evolving as a concept and is not yet a go-to design for managing enterprise secure access across users, cloud andbusiness requirements. As such there are several cautions worth highlighting:•	The scale of the change from a traditional networkand security concept to a SASE model should not beunderestimated. This is particularly important whereorganisations have entrenched network and security silos.

•	Organisations will also need to invest in new skills tomanage and troubleshoot a SASE environment. They willneed to ensure that the SASE technologies they invest in
have a suitable depth of troubleshooting capabilities.

•	Every SASE concept requires an underlay network (last andmiddle mile) which needs to be integrated or provided
separately from the SASE solution.

•	Conventional thinking suggests that SASE will reduce
costs as it will remove expensive standalone security andnetworking appliances (reducing licencing and supportcosts). However, in our view, as there is no overarching
platform today that can do everything, ROI will depend
on understanding the cost (both Capex and Opex) ofindividual components, such as CASB for example.
Organisations will be required to expend time and effort toundertake the required due diligence in order to integrate
individual components into the final architected solution.
As such, until this due diligence is undertaken, which
typically involves multiple stakeholders, it may not be
immediately clear where savings will occur or how soon
they can be realised.

•	The speed of change to a SASE model will also need to beconsidered, given that any adoption will require numerous
integrations and the deployment of a new overarching
platform.
•	Consideration also needs to be given to how security
operations will be tooled. Processes will need to ingest
new, and existing, data feeds from SASE solution
components to build intelligence into SIEM platformcorrelation rules. This will ensure enterprise users willcontinue to be protected as organisations move toward
the new target SASE model.

SUMMARY ANALYSIS OF THE SASE MARKET
Whilst it is fair to say that the SASE market is now established, it is also still evolving. There are several vendors that could become thedominant player but we do not yet believe that there is a clear leader in terms of features and functions now. With so many vendors
competing within this new market, selecting the right vendor to align to customer specific use cases is fundamental if business andoperational benefits are to be fullyrealised.

MAKING THE RIGHT DECISIONS
It is important that customers choose vendors based on validated use cases and a clear understanding of both functional and non-functional
requirements. This will ensure that value will be realised irrespective of the platform bought and that the operational and cost benefits fromconsolidation and optimisation when traditional platforms are removed can be realised, but with minimal business risk.

Network and security elements within the SASE stack

INTEGRATEDSECURITY

SASE Security
Functions

NETWORKOVERLAY

SD-WANServices

NETWORKUNDERLAY

NetworkServices

Web Security​(SWG,RBI,CASB,DNS)​

Additional Security
functions​

Infrastructure Security​(VPN,FW,IDPS)​

Mobile User Security​(ZTNA)​Application basedpath selection​

Performance/Bandwidth/WAN optimisation​

Zero Touchprovisioning​

Office and cloudconnectivity​

Last mile access/Internet access​Network-as-a-service​(LAN / WLAN)​Carrier functions​CDN​

It is important not to lead product selection in a feature-centric manner. This approach has proved expensive to customers who
inadvertently become locked into functionality that isn’t required and receive sub-optimal functionality in the areas most needed.
Finally choosing the right vendor can also help organisations realise a less complex solution that integrates better across all platforms.

SASE BUILDING BLOCKSSASE solutions have several architectural options that reflect both different organisational requirements and the layers of protection
required. It is our view that there are consistent, standard building blocks that should be incorporated into all SASE designs. These practicalcapabilities provide a firm foundation from which to build.

PaaS/IaaSInternetM365
Cloud/Hybrid
Web Security

SD-WANSD-WAN••••••

Location and cloudconnectivity/SD-WAN
Network security/Firewall (as a Service)
User access to private
resources /ZTNA
Optimal cloud service
access (SaaS)
Controlled internet
accessAdditional security
functions

SASE high level Reference Architecture

Location and cloud connectivity/SD-WAN
The secure SD-WAN overlay provides the secure connections
between sites and cloud enterprise resources (IaaS/PaaS).
Typically, a SD-WAN solution is the most flexible and effective way
to meet these communication requirements and provides
essential VPN encryption and base level security functionalities.

identity management solution, and has been assigned applicableprivileges based on role and context. Implementing this conceptof “Zero Trust”, where there is no implicit trust applied to resource
access, is a core component of SASE, and should provide continuous
control during a session.

Optimal cloud service access (SaaS)
Infrastructure security/Firewall (as-a-Service)
Infrastructure security functions like firewalls provide
communication control and are an important part of thearchitecture. They are inherently flexible and can be deployed indifferent ways. Deploying a Firewall as an edge service allows thearchitecture to follow SASE guidelines by moving the inspectionengine to the sessions and not vice versa. This would be applicableto locations where direct internet access is the main connectivity
pathway. Firewall-as a-service (FWaaS) brings this utility into thecloud, making it easier to consume than traditional firewalls.
Instead of requiring hardware to get the benefits of a firewall,
FWaaS extends the range of firewall capabilities to, and within, thecloud. This can be of significant value particularly to support mobileusers. A centralised policy management and control capability is an
important addition for both network security approaches.

User access to private resources/Zero Trust Network Access
User access to private resources requires secure connections
for both users and mobile devices to on-premise and cloudenterprise resources. Zero trust network access is where accessis authenticated once an identity has been validated, e.g. by an

Optimal access to trusted cloud resources, e.g. M365. With M365,
for example, the shortest, most direct route between the userand closest Office 365 endpoint will offer the best performance.
However, it is also important to avoid security functions whichintercept and decrypt network traffic in transit, because they oftenchange, scrub, or block decrypted content. Applying these features
to M365 user traffic, for example, causes changes to Office 365
protocols and data streams (outside standard and documentedAPIs). So an appropriate design which matches the needs of theSaaS application and provides adequate security is essential.

Controlled Internet AccessControlled access to Internet and public cloud resources via cloudor hybrid web security requires features such as Secure Web
Gateways, Remote Browser Isolation and DNS security.

Additional security functions
Overlaying additional security capability such as CASB, WAF (WebApplication Firewall) and advanced malware protection provide
added layers of protection for users of IaaS, PaaS and SaaS services.

OUR CONCLUSIONSASE will force the integration of network and security services
into one architecture. We do not believe that SASE signals the endof on premise or traditional infrastructure security vendors, but
the winners in this new market will be vendors with the mostcomplete portfolios or those with the most effective integrations
to third-party cloud resources or to the native providers
themselves. More recently, two terms are gaining in prominence
to describe the different types of SASE outcome:
Ingress SASE
Controls provide access from outside to internal applications
within the extended enterprise.
Egress SASE
Capabilities that help your users gain access to services
anywhere on the internet in a secure manner.

As these terms become common throughout the industry, it isworth considering if vendors can provide both outcomes or if
their solutions are more focused on one specific area. This will
help organisations to determine the right approach for a specificbusiness outcome.
Computacenter considers SASE as a destination that is reached instages. Starting with a clear defintion of requirements or security
outcomes, understanding which vendors to consider, developing
an understanding of the existing vendor landscape, identifying
options for consolidation or integration, and developing a target
design and architecture. These are just some of the activities wewould recommend discussing from this paper.

LET’S TALK
If you are considering SASE and are not sure where to start, Computacenter
can help. To access practical advice and guidance, understand youroptions and get support with defining your SASE strategy, architecture orvendor selection please contact your Computacenter Account Manager or
email us at SecurityEnquiries@computacenter.com.

About Computacenter
Computacenter is a leading independent technology
and services provider, trusted by large corporate andpublic sector organisations. We help our customers tosource, transform, and manage their IT infrastructure todeliver digital transformation, enabling users and theirbusiness. Computacenter is a public company quoted
on the London FTSE 250 (CCC.L) and employs over 20,000
people worldwide.

www.computacenter.com