SASE: Secure Access Service Edge
Distributed security architectures in the cloud
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: Network Security | Cybersecurity
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
You may have seen a new acronym floating around: SASE. I’ve been exploring the capabilities of this new class of security service offering. I talk about my take on security and cloud acronyms in my book: Cybersecurity for Executives in the Age of Cloud. A new one seems to pop up every week. I also write about the fact that with the migration to the cloud, the network perimeter isn’t going away. It’s changing.
With COVID forcing a rapid migration to work at home in 2020, it is even more critical than ever that organizations re-think on-premise architectures that don’t work very well in a distributed environment. And really, this new model is what the cloud is all about. It’s not just someone else’s computer. It’s a distributed architecture that provides scalability and flexibility, as I discuss in more detail in my cloud security class. SASE addresses the new perimeter by leveraging existing tools in a modern distributed architecture.
How does SASE fit into a security architecture?
First of all, let’s figure out the definition of this new acronym and what it means. It stands for Secure Access Service Edge.
- Secure means we want to make sure that what goes through this security service is safe and protected.
- Access indicates the ability to get to allow appropriate access to organizational assets.
- Service implies it’s a service model or providing access to services or both.
- Edge suggests that we have an endpoint on the perimeter of a network to which other devices connect.
I don’t know who comes up with these new terms, but Gartner seems to create product categories and provide information about the capabilities of different vendors in the space. Here’s how they define SASE:
“The secure access service edge is an emerging offering combining comprehensive WAN capabilities with comprehensive network security functions (such as SWG, CASB, FWaaS, and ZTNA) to support the dynamic, secure access needs of digital enterprises.”
Oh great. We have a list of more acronyms! I am not going to go into detail about all of these here but rather discuss conceptually the shift that is occurring. I’m working on an abbreviated 2-day version of my cloud security class for January 2020 and beyond where I’ll cover these a bit more in depth, but here are what the acronyms mean:
- SWG: Secure Web Gateway
- CASB: Cloud Access Security Broker
- FWaaS: Firewall-as-a-Service
- ZTNA: Zero Trust Network Access
Even without explaining all those acronyms, I can give you an idea of what SASE is and why it’s an idea whose time has come. I was going to write about an idea I had for a distributed VPN in the cloud for IANS to resolve performance and latency issues, but that thought is on hold at the moment. After spending some time reviewing SASE solutions, I’m thinking about different answers to the same problem that may be easier for some organizations. Whether or not you are comfortable using a SASE solution will depend on your organization’s specific security requirements.
Challenges with Cloud Network Access and a Remote Workforce
One of the core problems as we start moving everything to a distributed cloud architecture is this: How do we secure the myriad of network connections people create between the corporate data center and cloud environments, the corporate office and SAAS applications, and end-users, now distributed to everything? What about cloud application connections to other cloud applications? How can we monitor all the traffic between all these services and devices and keep it secure?
When you try to use your existing on-premises solutions to solve these problems here’s what you end up with:
Backhauling VPN traffic: When you want all your users to use your corporate VPN, all that traffic gets backhauled to your corporate network. Let’s say you have an employee in Seattle, but your headquarters and data center is in Miami. The employee needs to connect to Microsoft Office 365. The traffic gets backhauled to Miami when the person is likely close to a Microsoft endpoint near Seattle.
VPN performance issues: Another problem is that companies suddenly have many more remote workers trying to use their corporate VPNs, and those appliances are getting overloaded. Some people propose a split VPN, which can help, but what traffic do you choose not to protect with encryption and authentication in that case?
DNS lookup latency or other problems: Where will end-users’ DNS queries end up? Will they use your corporate DNS server? The DNS server of their ISP? How will they access private DNS servers? This seems to imply you need to be on the private network and probably need a VPN connection.
Internet-exposed traffic: How much traffic will traverse the Internet, and is it encrypted? Are full packets encrypted? Is all the traffic encrypted or just part of it in a split-tunnel or SSL VPN scenario? How much of it is captured for inspection? How will you ensure traffic is not intercepted or redirected as users work from home?
Authentication and authorization challenges: How will you prevent attackers on the Internet from accessing private applications when you have to allow remote workers to connect from many undefined and potentially changing locations? How will you ensure the person remotely logging in is the user they claim to be and is authorized to access the application?
Logging problems: If you try to consolidate all your logs from all these cloud services on premises you are back to having to provision enough servers and network bandwidth to handle all traffic and data. You may be able to do this effectively if you have a large organization and extensive security staff. But you’ll need to make sure you get all the logs from every cloud service connection. How will you capture all the logs from remote workers and can they connect to cloud services without going through your VPN or security appliances? What about cloud to cloud connections?
SASE — the solution to many cloud connectivity problems
For all these reasons, you may want to take a look at these new and emerging services — the kind of solutions I imply with my discussion of new cloud perimeters in my book. The current state of every SASE may not solve every one of the issues I just mentioned, but they are moving in the right direction. Here are some of the benefits and drawbacks you will want to consider when evaluating a SASE solution.
Instead of skipping network security because it’s too hard, distribute your edge on a secure, trusted, global network. Use a combination of a centralized cloud service and edge endpoints to optimize and secure Internet traffic. Block known-bad traffic as early as possible at the edge, but capture what you need to analyze in a single location where you can both alert on suspicious behavior and prevent attacks.
Create the dream — the single pane of glass for all your traffic — at some intermediary point in the cloud. That idea is something I talked about years ago in a talk on Security for Complex Networks on AWS. By sending all the traffic through some centralized VPC, you could monitor it. I would change some things in this old slide deck, but the concept remains relevant. Create a point where you can capture, inspect, and analyze all your traffic. Since then, AWS has come out with the AWS Transit VPC and now has a packet capture service called Traffic Mirroring. SASE takes this to a new level by capturing and inspecting all the traffic in a distributed network architecture consisting of remote end-users, corporate offices, and cloud providers.
Manage, secure, and improve the performance of cloud application connections. By sending your traffic through the SASE service, you can identify cloud services and allow and disallow access. If the provider has an extensive network, your employees can connect to the closest endpoint and go through the SASE network directly to the cloud service provider — sometimes in one hop. That may help eliminate some rogue routers, potential man-in-the-middle (MITM attacks), and improves performance.
Some providers offer secure, low latency DNS offerings. They may provide faster query resolution, block known-bad domains, and connect more directly to authoritative DNS servers for the cloud services you use. How do you know a DNS cache at a local ISP doesn’t contain a compromised domain record pointing to an incorrect Microsoft update server? Or are you sending all those DNS queries back to your corporate network?
Some of these services claim to replace a VPN. Whether or not they can do this depends on your concept of a VPN and the protection it provides. A VPN can provide an encrypted tunnel for all your traffic between your end-user and your VPN appliance on an internal, private network. Does a SASE solution truly provide an equivalent solution?
Perhaps today, your VPN appliance resides in your data center. Once a client connects ALL the traffic, and the full packet on the end-user machine is authenticated and encrypted end-to-end once they connect to your VPN. That includes the payload and headers in every packet, not just specific ports or protocols or portions of the packet.
Now let’s say the traffic goes to the SASE. Does all the traffic and the full packet get encrypted, or just the traffic from the client to a specific application? Does the provider offer TLS inspection (many call it SSL in their marketing). Do you want the SASE provider to see and inspect that traffic? It depends on your level of trust. Make sure you perform an appropriate vendor security assessment, as I wrote in another post.
Can you inspect the traffic down to the packet level in the network (as opposed to on the host)? That was one of the features that felt like it took forever to get to the major IAAS cloud providers. Do you trust the SASE provider to inspect that traffic, or do you want the capability to analyze it yourself if you suspect a security incident? Do you have access to it, or is that within the realm of the SASE provider’s responsibility?
I recently tweeted about another blog post explaining compromised Intel hardware (and note the comments about AWS hardware, if you’re interested):
The author points out that the only way you know that an attacker has compromised your system would be by looking at the network traffic. Could you determine system compromise of a remote worker’s machine by a domain name or IP address alone? Or would you perhaps need those packets? Some attacks leverage network packet manipulations that are only visible if you have the entire packet with the headers and payload.
And of course, if the host is compromised, any host-based packet captures may be as well. Does the SASE solution provide packet-level inspection on the network? Do you need it? It depends on whether you look at those network packets right now and if you create and maintain a customized ruleset in your preferred NIDS or NIPS.
If you find the SASE security is as good or better than your requirements, then the benefit of using one of these services is their ability to leverage machine learning to find security threats across large data sets to find security problems in network traffic. They may be able to stop large-scale attacks quickly. You may want to review their history and ability to do so by seeing how they responded to past large scale malware outbreaks. What sort of protection was the vendor able to provide in those cases if that is your objective.
Alternatively, your objective may be more directed at improving network performance and offloading your corporate VPN appliances. You might opt to continue to use your MPLS connections, keep the traffic private, and overlay with vendor services to improve connectivity. Does the SASE support this? In some cases, you can continue to use IPSEC for some traffic between your locations for end-to-end encryption. You may not want the SASE to perform TLS inspection for that traffic. Does the SASE support this?
Most of these services provide integration with your identity provider (IDP). For example, they may integrate with Azure AD or OKTA so you can give specific users access to particular applications. Some SASE providers can leverage the contextual access provided by some IDPs, such as only allowing hosts from a certain IP range or have antivirus software installed. They may provide some form of conditional access themselves.
Often the service provides application-level access controls as opposed to pure network access. The service gives a specific user access to a particular application if they authenticate and meet the conditional access requirements. For example, a SASE may allow you to create a rule that a user can only to your corporate Slack account via Azure AD if their username contains your domain name, and they are in a particular geographical location.
Providing access at the application layer may have implications regarding what kind of network and access logs you’ll get from the SASE vendor related to these connections. It is not an apples-to-apples comparison to connecting over a private network connection to a cloud-hosted application. You may be depending on that vendor to keep traffic logically segregated within their system via their software, as opposed to network controls or a private MPLS line. In many cases, it’s not the equivalent of a VPN connection where all traffic flows through an encrypted tunnel between the end-user and your corporate network.
SASE Benefits
The combination of network, encryption, and identity controls in a SASE solution provides multiple layers of protection for a defense-in-depth solution. The centralized management may prove to be beneficial for security teams trying to get a handle on all their cloud applications and traffic flowing to, from, and between cloud endpoints. Leveraging a global network with direct access to many of the most prominent cloud providers and the ability for end-users to connect to nearby endpoints may provide a way to offload corporate VPN appliances and provide a better user experience. Whether or not you want to use one will depend on your specific security requirements.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2020
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
