SASE, Secure Access Service Edge, which is what we often call the secure access service edge, is an IT service product delivered as a distributed cloud service that combines WAN functions and Network Security as a Service.

According to Gartner's "The Future of Cloud Security: China's Edge Access Service Architecture", SASE is a service based on entity identity, real-time context, enterprise security and compliance, and continuous assessment of risk and trust. To put it simply, SASE is a converged service of network and security.

Comparison between SASE and traditional network security architecture:

Traditional network security architecture

Most traditional network security models rely on VPN technology and connect to endpoints via SSL/TLS; SASE can replace VPNs. Users can access local resources or cloud services by connecting to SASE. Enterprise security rules can be defined and enforced through SASE.

Access cloud resources

The traditional network security model uses traditional firewalls and path control; SASE provides cloud network connections to access SaaS, PaaS and IaaS.

Access control

Most on-premises network security relies on switching, routing, proxies, and firewalls to control network access; SASE provides an architecture that integrates network security and access control.

SD-WAN and WAN optimization aspects

These usually require many agents and different products to implement related functions, and different products are difficult to integrate and collaborate; SASE puts SD-WAN and network optimization into the same framework to provide overall services for all types of access acting.

Threat detection

Traditional network security models use NGFWs, detection sandboxes or CASB; SASE integrates all network threat detection capabilities into the same service architecture.

Network security services

Traditional network security models WAF are usually separate applications and platforms, or use cloud resources/content distribution through service agents; SASE integrates WAF rules and services into the same service agent path.