SASE — Secure Access Service Edge

Secure Access Service Edge (SASE, pronounced "sassy") is a framework defined by Gartner in 2019 that converges wide-area networking (WAN) and network security services into a single, cloud-delivered platform. The core idea is to provide secure, fast access to applications and data regardless of user location, device, or application hosting (on-premises, cloud, or SaaS). Traditional network security models rely on a centralized data center where all traffic is backhauled for inspection. This creates latency, scalability issues, and poor user experience for remote workers. SASE shifts security and networking to the edge of the network—points of presence (PoPs) distributed globally—so that security policies are enforced close to the user or branch.

For SY0-701, you need to know that SASE is not a single product but an architecture combining multiple technologies: SD-WAN (Software-Defined Wide Area Network), SWG (Secure Web Gateway), CASB (Cloud Access Security Broker), ZTNA (Zero Trust Network Access), and FWaaS (Firewall as a Service). These components work together to provide identity-driven, context-aware access while optimizing network performance.

SASE operates on a cloud-native model where a global network of PoPs acts as the enforcement points. Here is the step-by-step process:

3. Security Inspection at the PoP: All traffic is inspected by the integrated security stack at the PoP. This includes: - SWG: Blocks malicious websites and enforces acceptable use policies. - CASB: Scrutinizes traffic to cloud applications (e.g., Office 365, Salesforce) for data loss prevention (DLP) and shadow IT. - FWaaS: Provides stateful firewall, intrusion prevention (IPS), and DNS filtering. - ZTNA: Authenticates the user and device, verifies identity and posture, and grants least-privilege access to specific applications (not network access).

Defender Deployment: Deploying SASE involves: 1. Selecting a SASE provider (e.g., Zscaler, Palo Alto Prisma Access, Cisco Umbrella, Netskope). 2. Configuring SD-WAN at branches and deploying client software on endpoints. 3. Defining policies in the cloud console. 4. Integrating with existing IdP and DLP solutions. 5. Testing and gradually migrating traffic from legacy VPN/firewall.

Attacker Exploitation: Attackers may target SASE by: - Compromising the Identity Provider: If an attacker gains control of the IdP, they can impersonate users and access applications. Mitigation: MFA, conditional access policies. - Exploiting TLS Interception: If the SWG's TLS inspection is misconfigured, attackers could bypass inspection. Mitigation: proper certificate management and strict TLS policy. - PoP Compromise: Though rare, a compromised PoP could expose traffic. SASE providers use zero-trust architecture within their own network. - Client-Side Attacks: If the ZTNA client has vulnerabilities, attackers could exploit them. Mitigation: regular patching and endpoint detection and response (EDR).

Example Command/Tool: In a SASE environment, an administrator might use a cloud console to view traffic logs. For example, Zscaler's console shows logs for each transaction:

Timestamp: 2024-05-01 12:00:00  User: jdoe@company.com  Action: Blocked  Category: Malware  URL: evil.com

Or use API to extract logs for SIEM integration.

Zscaler is a leading SASE provider. ZIA provides SWG, FWaaS, and CASB. When a user browses to a website, the traffic is redirected to the nearest Zscaler PoP. The PoP performs:

If the traffic is allowed, it is forwarded to the internet. All this happens in milliseconds.

SY0-701 expects you to understand SASE as a modern alternative to traditional network security. Be able to identify the components (SD-WAN, SWG, CASB, ZTNA, FWaaS) and explain how they work together. Know that SASE is cloud-delivered, identity-centric, and supports remote access. Contrast it with traditional VPN and data center-centric models.

Scenario 1: Remote Worker Access to Internal App

A company with 5,000 remote employees uses Zscaler SASE. An employee, Alice, connects from a coffee shop. Her ZTNA client authenticates via Azure AD (MFA enabled). The client checks device posture: OS updated, antivirus running. It then establishes a tunnel to the nearest Zscaler PoP. Alice requests access to the internal ERP system hosted in AWS. The PoP's ZTNA broker verifies her identity and grants access only to the ERP app (not the entire network). The traffic is proxied through the PoP, which also applies DLP and IPS. The SOC sees a log: User: alice@company.com, App: ERP, Action: Allow, Source IP: PoP IP, Destination: AWS. If Alice's device had malware, the PoP would block the connection. A common mistake: IT might have configured a VPN that gives full network access, increasing risk.

Scenario 2: Branch Office with SD-WAN and SWG

A retail chain with 100 stores uses Cisco Umbrella SASE. Each store has an SD-WAN router that connects to two ISPs. The router steers Office 365 traffic directly to Microsoft (optimized path) and web browsing traffic to the nearest Umbrella PoP for security inspection. The PoP blocks access to a phishing site that targets retail employees. The SOC receives an alert: Threat: Phishing, URL: fake-retail-login.com, Action: Blocked, Source: Store 42. The analyst verifies the block and updates the policy to block similar domains. A common mistake: not enabling TLS inspection on the SWG, allowing encrypted phishing traffic to pass through.

Scenario 3: Cloud Migration and CASB

A financial services firm migrates to Salesforce and Office 365. They deploy Netskope SASE with CASB. The CASB discovers that employees are using an unsanctioned file-sharing app (shadow IT). The policy blocks access to the app and alerts the SOC. Additionally, DLP rules prevent credit card numbers from being uploaded to Salesforce. The SOC sees a log: User: bob@firm.com, App: Unsanctioned Cloud, Action: Blocked, Data: None. A common mistake: not configuring DLP for all cloud apps, leading to data leakage. The correct response is to configure policies for all sanctioned apps and block unsanctioned ones.