Single Vendor SASE: Why it’s a Myth, at Least for Now

Introduction

Enterprises are constantly seeking innovative solutions to meet their growing network and security needs while driving operational agility. Secure Access Service Edge (SASE) is one such solution that has been gaining popularity. However, a common misconception has started to emerge: the idea that a single vendor can deliver a comprehensive SASE solution. This article will debunk that myth and shed light on why outcome-based services from Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) are often the better choice.

So, what is in the SASE Framework?

The SASE solution stack comprises a blend of conceptual IT management principles and tangible technologies, coming together to create a comprehensive and secure environment.

Here’s a breakdown:

Core Principles

• Zero Trust Network Access (ZTNA): The foundation of ZTNA is a “never trust, always verify” approach. Every user and device must be authenticated and authorized before they gain access to the network, minimizing the risk of inside threats and data breaches.
• Identity-Driven: In a SASE architecture, access and security policies are tied to user and device identities, not their physical locations. This tenet ensures that policies remain consistent and are enforced, irrespective of where the user or device is connecting from.
• Globally Distributed: SASE solutions are designed to be cloud-native and globally distributed, providing optimized access, secure, and with a consistent experience to all users, regardless of their location.

Technologies

• Software-Defined Wide Area Networking (SD-WAN): The networking backbone of SASE is SD-WAN. It connects disparate enterprise networks – including data centers, remote offices, and mobile users – to provide reliable and efficient orchestration of network connectivity.
• Secure Web Gateway (SWG): SWG provides real-time web content filtering and malware detection. It ensures secure internet access by blocking malicious content and websites down to users through network and cloud-based enforcement points.
• Firewall-as-a-Service (FWaaS): Delivering inbound firewall capabilities via the cloud, FWaaS provides comprehensive threat protection and enforces security policies across all inbound network traffic; depending on the capabilities, these can also be called Web Application Firewalls (WAFs) and are used to inspect inbound traffic from the internet to servers.
• Cloud Access Security Broker (CASB): CASB allows organizations to extend their security policies to SaaS applications, providing visibility, threat protection, and data security. They provide more than just binary access control and can be used to restrict functional access based on conditions.
• Data Loss Prevention (DLP): DLP tools monitor and control data movements across the network, datastores, and endpoints, ensuring the protection of sensitive information.

Together, these conceptual tenets and technologies create a unified SASE framework that ties together network infrastructure and security services. This integration results in improved user experience, heightened security, and enhanced operational efficiency.

Understanding SASE and How It Differs from Just “SD-WAN + Security”

In simple terms, SASE is a comprehensive model that integrates network security and wide area networking (WAN) capabilities with cloud-based orchestration. However, SASE is more than just SD-WAN coupled in parallel with security tools. While SD-WAN focuses on connecting diverse networks, and standalone security services aim to protect specific systems, functions, or endpoints, SASE merges these functionalities, providing seamless and secure network access regardless of user location.

While integrating SD-WAN into a security solution might seem like a straightforward way to combine network management and security, it’s crucial not to treat these as two separate functions. It’s vital that your SD-WAN solution governance is seamlessly integrated with security in a unified policy framework; this integration is more important than technological or platform integration a single vendor solution seeks to achieve.

Without this governance integration, there is a risk of creating an environment where the network and security components operate in silos. This will lead to inconsistent policy enforcement, gaps in security, and complexities in management. The key is to ensure that SD-WAN and security elements within SASE are inherently interwoven enabling coherent policies and streamlined management, thus truly unlocking the potential of SASE as a consolidated networking and security platform.

Network Transformation: Where to Start

SASE and Security Frameworks: A Complementary Relationship

While SASE provides a technology framework to support the secure transmission of data and secure access to applications and resources, it should not be viewed as a replacement for established security frameworks such as NIST, CIS, or ISO27001. These frameworks provide comprehensive guidelines on how to secure information and establish strong cybersecurity controls. They cover a range of elements, from risk assessment and identity management to incident response and recovery procedures.

SASE complements these security frameworks by providing the technological means to implement their principles. For instance, the Zero Trust principle of SASE aligns with the access control and identity verification requirements emphasized in these security frameworks. The cloud-native and globally distributed architecture of SASE also resonates with these frameworks’ emphasis on resilience and recovery.

Moreover, SASE can aid in regulatory compliance for industries bound by strict regulations and where maintaining data security and privacy is paramount, such as healthcare (under HIPAA) or finance (under GDPR). Here, the unified visibility and control offered by the SASE technology framework is critical.

The Overpromise of Single Vendor SASE Solutions

The allure of single vendor solutions is understandable. They promise simplicity, integration, and a single point of contact for support. However, in practice, finding a single vendor that excels in all the areas encompassed by SASE can be a daunting, if not impossible, task, and that’s before layering in the unique requirements of your business.

Network solutions and security are complex fields, each comprising multiple sub-disciplines. It’s rare to find a single vendor with top-tier expertise in all these areas. Besides, sticking with a single vendor can lead to vendor lock-in, reducing flexibility and potentially leading to higher costs in the long run.

The Right Solution (for most): Outcome-Based Services from MSPs or MSSPs

This is where MSPs and MSSPs come into the picture. They provide businesses with access to a pool of experts in various fields, offering customized solutions based on each company’s unique needs. MSPs and MSSPs monitor, manage, and secure your network infrastructure, providing outcome-based services that ensure your IT operations are effective and efficient. They can leverage best-in-class vendors for each part of the SASE tech stack but reduce the friction that can be caused by having multiple solutions.

Secondly, staffing your own company with experts is often a Herculean task. According to (ISC)2, at the end of 2022, there was a global cybersecurity worker gap of 3.4 million skilled individuals. This is a staggering figure that highlights the critical shortage of cybersecurity professionals. Moreover, when it comes to hiring highly qualified cybersecurity experts, the cost can be prohibitive for many businesses. Entry-level analysts can easily cost upwards of $100k with benefits, while seasoned leaders and architects can be $250k+.

By partnering with an MSSP, businesses can gain access to a team of seasoned cybersecurity experts at a fraction of the cost of hiring in-house. This not only alleviates the pressure of finding and retaining top talent but also ensures that your security posture is continuously updated and fortified by professionals who live and breathe cybersecurity. Choosing MSPs and MSSPs over a DIY solution allows IT teams to focus on their core competencies and aligning strategic initiatives to the needs of the business, while leaving their management of network and security needs in the hands of trusted experts. This approach drives enhanced security, access to the latest technology, cost savings, and most importantly, peace of mind through risk abatement.

SASE? Sign Me Up! But how do I get Started?

As your business prepares to adopt a SASE solution stack, there are four critical steps to kickstart your evaluation process:

1. Define Your Business Requirements: Start by identifying your unique business needs and objectives. What challenges are you trying to solve? How do you envision SASE addressing these issues? Consider your business’s size, nature, the geographical spread of offices, remote work policies, and specific industry regulations you must comply with.
2. Assess Your Current Infrastructure: Examine your current network and security infrastructure. Determine what’s working and what isn’t. This assessment will help you understand what needs to change and where SASE can fill the gaps.
3. Identify Potential Vendors and Partners: Research potential vendors, focusing on their ability to meet your specific needs. Look into their expertise, track record, the comprehensiveness of their SASE solution, customer support, and cost.
4. Benchmark Solutions: Create a requirements rubric that allows you to standardize, normalize, and compare vendors and partners that you are considering. You will need to consider both quantitative data like price, licensing model, and term, as well as qualitative assessments from your stakeholder about ability to deliver, internal technical acumen, and integration into your operations.

As you undertake this evaluation process, here are key questions to consider:

• What are our main business objectives that a SASE solution should support?
• How do your users access data and tools today and how might that change in the future?
• What are the security and networking challenges you are currently facing?
• How will adopting a SASE solution improve our current infrastructure?
• What kind of network traffic and security policies do you need to enforce?
• How capable are you in managing a SASE solution in-house?
• What is your budget for implementing and maintaining a SASE solution?
• What is your timeline for SASE adoption?
• What level of customer support will you require from the SASE vendor or MSSP?
• What are the business impacts of a security event?

Additionally, quantitative data plays a crucial role in your SASE evaluation, allowing you to assess your needs and evaluate potential solutions more accurately. Here are some key data points you should gather:

• Number of Network Users: This includes full-time employees, part-time staff, contractors, partners, and customers who access your network.
• User Locations: Determine how many of your network users are in-office, remote, or mobile. This should include geographical data on distributed offices or remote employees.
• Device Count and Types: Count the total number of devices accessing your network, including laptops, smartphones, tablets, IoT devices, etc. Knowing the types of devices will help ensure the SASE solution can handle all device requirements.
• Application Usage: Identify the applications your business uses, the data they handle, and the network resources they consume. This data can help you understand your bandwidth needs and security requirements.
• Current Network Performance Metrics: This includes latency, packet loss, and jitter, which can indicate the quality of your current network and identify areas for improvement.
• Security Incidents: Gather data on the number, type, and severity of past security incidents. This can guide your focus on specific security features in a SASE solution.
• Cost Data: Calculate the total cost of your current network and security infrastructure, including hardware, software, maintenance, and personnel costs. This will provide a benchmark for evaluating the cost-effectiveness of a SASE solution.
• Compliance Requirements: Quantify the number of regulations your business needs to comply with, which could affect your SASE requirements. Also consider any specific requirements from your cybersecurity insurance or client agreements.
• Network Traffic Data: Understand your average and peak network traffic levels. This can help ensure your SASE solution can scale to meet your needs.

These steps, questions, and datapoints will guide your preliminary evaluation process, setting the stage for a deeper dive into potential solutions and vendors. Remember, adopting a SASE solution is a strategic decision that should align with your overall business strategy and IT roadmap.

Why use an Advisory Firm for SASE Transformation?

In the complex world of network and security transformation, the guidance of a seasoned advisory partner is an invaluable asset. These companies bring a wealth of industry knowledge and experience, guiding you through the process of SASE solution evaluation with expert advice and personalized service.

Advisory firms, like Bluewave, specialize in understanding your unique business needs, current infrastructure, and future goals. They evaluate potential vendors on your behalf, considering factors such as scalability, reliability, support, and cost-effectiveness. This allows you to navigate the numerous SASE solutions available, saving you time and resources while ensuring that the chosen solution fits your business like a glove.

Moreover, these firms continue to provide support and advice after the implementation, helping you realize value from your investment. With their guidance, your business can smoothly transition to a SASE framework, enhancing your network performance and security, and ultimately driving your business growth without putting undue strain or stress on your IT team. Leveraging an advisory company’s expertise is not just a wise choice—it’s a strategic move towards a successful transformation.

Conclusion

Achieving a successful SASE implementation goes beyond the single vendor solution myth. It requires the collective efforts of specialized vendors brought together by MSPs and MSSPs to create a tailor-made, outcome-based solution. Businesses must adapt and make strategic decisions that align with their specific needs.

As a premier advisory firm, Bluewave guides businesses through this process, providing expert advice and services to ensure your company achieves the desired outcome and expected value from your technology investments, including SASE.

Request a Consultation