SASE and SSE are two names for network security delivered from a security company's cloud, which every laptop and branch office connects to first, wherever it is. SASE, often pronounced "sassy", stands for secure access service edge. It combines the security checks with the networking that carries the traffic, called SD-WAN. SSE, or security service edge, is the security half alone, without the networking.
Why did this appear? For years, each branch office sent its internet traffic over an expensive private line to the head office. The head office firewall checked the traffic and sent it on to the internet. Staff at home connected to the head office through a VPN. This made sense while the applications were in the head office. Now most of them are cloud applications, such as email, the CRM and the HR system. Sending all the traffic through the head office makes it slow, and the private lines cost a lot.
With SASE, the checks move to the cloud. The security company runs data centres in many cities. Each one is called a point of presence. A laptop or a branch office connects to the nearest one over an ordinary internet connection. There, the traffic is checked. Then it goes straight on to the internet or to the cloud application.
Consider an insurance broker with 40 small branches across Kerala and its head office in Kochi. Before, every branch reached the internet through Kochi, and opening the company's email took several seconds. Now, each branch connects over a broadband line to the security company's nearest point of presence, in Chennai or Mumbai. The checks are the same as before, but email opens at once. The broker also stops paying for 40 private lines.
SASE is sold as one bundle of several parts. A secure web gateway filters websites. A cloud access security broker (CASB) watches what staff do inside cloud applications. Zero trust network access (ZTNA) connects each user to one application only. Browser isolation keeps web pages from running on the laptop at all. All of these parts follow one idea, zero trust: every request is checked, wherever it comes from.
Each check starts with who the user is. So SASE asks single sign-on (SSO) to confirm the user. Files leaving the company are checked against data loss prevention (DLP) rules. Every check is logged to the SIEM. Many companies keep a firewall at the head office and use SASE for their branches and remote staff.