Cloud Hosting

Analysis The emergence of secure access service edge (SASE) dominated the networking market for the last few years as enterprises sought to address increasingly distributed IT environments.

SASE hit the lexicon after 2019 took hold as enterprises started to see a possible route in the convergence with software-defined WAN (SD-WAN) and network security functions for threat protection, zero-trust features, firewall-as-a-service (FWaaS) and cloud access security broker (CASB), all delivered as a cloud service.

Now comes security service edge (SSE), which pulls back the security functions in SASE into a unified services offering that includes CASB, zero-trust network architecture (ZTNA) and secure web gateway (SWG). SSE came in the wake of the COVID-19 pandemic, with most employees being sent home to work and putting in motion the ongoing trend toward hybrid work.

With many people working from home at least part of the time, the role of branch offices is lessened and the need for security features that follow workers where they are with work days starting from home and then moving to offices or other locations is growing.

What the role of SSE is in the larger network security space is and what it means for the future of SASE are the subjects of some debate in the industry. However, it puts a spotlight on the ongoing evolution of networking as the definition of work continues to change and the focus of IT shifts from the traditional central data center data and workloads in the cloud and at the edge.

Once the pandemic hit, "it was no longer about branch offices," said John Spiegel, director of strategy at Axis Security, which in April launched Atmos, its SSE platform. "It was our users taking their branch office to the home, to their garages, to their basements ... [and] collaborating with their fellow workers via Zoom. The whole thing changed and that's where we saw the utility of SD-WAN really decline."

Enterprises could put WAN devices in every employee's home, but that's expensive and complex, Spiegel told The Register.

"Instead, we pivoted back to this SSE model, which is really about delivering applications," he said. "At the end of the day, that's what a CIO, a leader cares about. It's the delivery of an application. We're getting down to that lowest common denominator and that's the user and that's really where secure service edge is and that's where we see the opportunity."

Gur Schatz, founder and COO at Cato Networks, sees it another way. The company recent months has added such features to its SASE platform as risk-based application access control to address what officials see as limitations in offerings that focus only on ZTNA and SSE and a CASB. People will continue to go to offices to work, there will always be SD-WAN and firewalls, data centers and cloud providers like Amazon Web Services and Microsoft Azure, Schatz told The Register.

The long-term trend will be adding more functions into the SASE environment, he said. SASE is not easy for enterprises to adopt and SSE is a step down the inevitable path toward SASE, which addresses issues of cost and complexity when trying to merge networking and security

"Maybe the topology changed from having branch offices communicating with headquarters to branch offices communicating with data centers or with SaaS applications, but the network is still there with you," Schatz said. "Everything converges and you have a single security posture that covers holistically what you need. It's unreasonable to get this amount of complexity and try to maintain security on top of it."

Gartner, which defined SASE, did the same with SSE last year and in February released its SSE Magic Quadrant, with Zscaler, Netskope and McAfee (which created Skyhigh Security by combining its SSE tools with FireEye's) as leaders and others like Palo Alto Networks, Cisco, Forcepoint and Lookout in play.

In addition, Gartner analysts last fall listed both SASE and SSE as must-have cloud security technologies for 2022, with SASE predicted to have a transformational impact in the next two to five year and SSE a high impact over three to five years.

While global SD-WAN revenue did slow in 2020 due to the pandemic and the dramatic to work-from-home, Dell'Oro Group analysts said the market came roaring back last year, growing 35 percent year-over-year and hitting record revenue of more than $2 billion as organizations optimized their branches for cloud services and adopted SD-WAN for their widely distributed workforce.

That said, there are issues with SD-WAN, including the costs that come with adopting it and an implementation phase that can take years, according to Netskope Chief Strategy Officer Jason Clark. In addition, SD-WAN tends to be an on-premises technology that addresses east-west network traffic, which doesn't fit as well when users are going into the cloud.

"For anything north-south, I'm going to my SSE," Clark told The Register.

SASE essentially has been trying to create a Frankenstein monster-like tool package, with network technologies coming from networking vendors and security tools from various security players, he said. Palo Alto is one of the few companies that owns both and is working to meld them together.

"The reality is that you have a really strong SD-WAN vendors who suck at security," Clark said. "You have really, really good security companies, but they're not SD-WAN companies. Then you've got people who are trying to play in the middle. What happened is the buyers told Gartner the security-minded buyers need the best-of-breed security. Two-thirds of them said, 'I need the best SD-WAN and I need the best security. I found nothing that does both awesome.'"

When a user moves off the SD-WAN and into the cloud from home, a lot of the controls in the on-prem network are gone. Netskope's worldwide network is designed to deliver security capabilities once the user hops into the cloud, which is important given that about half an enterprise's traffic is in the cloud, Clark said. Before the pandemic hit, it was about 15 percent, he said.

David Hughes, who was founder and CEO of SD-WAN vendor Silver Peak until Hewlett Packard Enterprise bought it last year for $925 million and folded it into its Aruba Networks business, said Gartner defining SSE is a plus because it clarifies what SASE is the on-prem SD-WAN and cloud-delivered security services.

"It gives the IT administrator a clearer idea of the tradeoffs they would be making if they go with one vendor for everything vs. going with a cloud vendor plus an on-prem vendor," Hughes, now Aruba's chief product and technology officer, told The Register.

"We've always felt that, especially for the larger enterprises, going with a leader in the cloud-delivered security plus a leader on-prem [is best]. That's what we see happening in the large enterprise. As you come down-market, there's a desire for being able to have one throat to choke. What the Magic Quadrant shows is as you come down there, you're having to make some compromises. The split in the analysis helps people see what those compromises might be."

However, the evolving demands for networking security will continue to push the market toward convergence, Cato's Schatz said.

"Eventually all roads lead to SASE," he said.

Visit link:
SSE kicks the A out of SASE - The Register