Why SASE — an emerging cybersecurity term — is crucial for protecting your company's work-from-home data and systems

• Coined in 2019, SASE is a cybersecurity term that includes key zero-trust technologies.
• The zero-trust framework authenticates a user every time they try to use their company's system.

Technologists love their acronyms. They use them for everything — company names, products, technologies, standards, and trends.

One of the newest additions to the tech-acronym universe describes a cybersecurity principle rather than a tangible product or service. The term, known as SASE (pronounced sassy), is becoming the go-to jargon for what is already known as a zero-trust environment — a system that authenticates a user every time they try to use their company's system.

Coined in 2019 by research company Gartner, SASE, which stands for Secure Access Service Edge, is a security architecture that encompasses multiple technologies and is the core component of what makes up a zero-trust framework.

SASE includes a range of existing and new technologies that operate together and secure not only the network's edge – defined as a device anywhere in the world that connects to the corporate network – but also the company's cloud environment.

In order to be considered SASE, Gartner says the technology must be identity-driven, have a cloud-native architecture, support all network edges, and be globally distributed. This is especially important since today's users can access their company's network from a range of sources, including a traditional computer, cellular device, embedded sensors in gadgets, kiosks, and more.

"You may find that you already have many of the required components in place, and now need to apply some elbow grease to orchestrate them together," Paul Matvey, a cybersecurity manager at Echelon Risk + Cybere, said.

Gartner defines SASE according to five key components:

1. A software-defined, wide-area network that allows organizations to use both software and hardware from multiple vendors.
2. Contains Firewall as a Service, a cloud-based app that replaces hardware firewalls in an organization.
3. Features a secure web gateway, which is defined as a content filter that blocks malicious traffic, such as malware or ransomware.
4. On-premise or cloud-based cloud access security brokers that monitor both outbound and inbound traffic for security and policy compliance.
5. A zero-trust network access that replaces current virtual private networks that increases the security of today's hybrid workforce.

While organizations can buy individual products to address each of these elements, there is no guarantee that the products work well together, even when purchased from a single vendor. By being SASE-compliant, vendors can assure their customers that the products have been tested to work as expected.

But before companies purchase SASE-based products, they need to understand their larger cybersecurity goals and priorities.

• What are we trying to protect? Access to the networks, applications, and critical data.
• Why are we protecting it? The data is of particularly high value to the organization.
• Where is the data located? Network, cloud, email.
• Who needs access to the data? The concept of least privilege comes into play here, which only grants the minimum amount of access and capabilities required by any user or service at a given time.
• How? Technology controls that automate your security policy.

Why SASE is key to a remote-first work environment

The importance of securing the network's edge cannot be underestimated, considering that edge might exist anywhere, including on another company's network, in the cloud, or somewhere far from the control of the corporate IT security team.

Should attackers gain access to the corporate network or cloud services, the consequences could be dire.

While David Gochenaur, the senior director of cybersecurity at Ensono, understands that the SASE framework can appear complicated and intimidating at first, he said this secure solution can offer greater agility and options for companies of all sizes and work structures.

Zero trust "is a security approach that reveals the truth to us: Nothing can be trusted, and we must validate [every user, device, and application] for ourselves," Catalino Vega III, senior security analyst at Kuma LLC, said.

"The faster we come to terms with this fact, we can tailor our security program to incorporate this approach and drastically reduce our risk landscape," he said.