Quick answer: SASE (Secure Access Service Edge) is an architecture that combines network and security services into a single cloud based layer. It contains network components such as SD-WAN together with security components such as a secure web gateway, CASB, ZTNA and firewall as a service. SSE (Security Service Edge) is only the security side of SASE, without the network component. Both run not at the center but at the cloud edge closest to the user.

Why did SASE emerge?

The old model was simple. Everyone was in the office, data was at the center, and security was a box the traffic passed through at the center. A remote worker connected to the center over VPN and all their traffic passed through it.

That model has collapsed today. Users are everywhere, applications are in the cloud, and most traffic no longer sees the center at all. Routing everything through the center is both slow and insecure. SASE answers this by taking security away from the center and moving it to the cloud edge closest to the user. So wherever the user is, the same security policy is applied at the point nearest to them.

The components of SASE

Component Function
SD-WAN Intelligently routes network traffic (network side)
SWG (Secure Web Gateway) Filters web traffic, blocks malicious sites
CASB (Cloud Access Security Broker) Makes cloud app usage visible and controlled
ZTNA (Zero Trust Network Access) Grants identity and context based access to apps
FWaaS (Firewall as a Service) Delivers the firewall as a cloud service

These components also exist as separate products. What makes SASE different is combining them into a single integrated cloud service at the edge closest to the user.

The difference between SASE and SSE

Topic SASE SSE
Scope Network (SD-WAN) + security Security only
Contents SWG, CASB, ZTNA, FWaaS, SD-WAN SWG, CASB, ZTNA, FWaaS
Who it fits Those transforming network and security together Those wanting to start with security first

In practice SSE is the first step on the road to SASE for most organizations. Those who want to move the security layer to the cloud without immediately changing their network infrastructure start with SSE.

The evolution from VPN to ZTNA and SASE

The evolution of remote access can be summarized as follows. First there was VPN, which connected the user to the entire network, creating a broad trust zone. Then came ZTNA, which connected the user not to the whole network but only to the application they need, with identity and context control. SASE then combined ZTNA with the other security and network components into a single cloud architecture. So SASE is the architecture that makes the zero trust principle holistic at enterprise scale.

The KAOS and DSET approach

DSET evaluates organizations' remote access and network security architecture against the zero trust principle and plans a SASE or SSE transition by business priority. We focus not on selling a new product but on finding the real gaps in the existing architecture (such as overly broad VPN access or unmonitored cloud app usage). Our KAOS security engine reports such weak access configurations during attack surface scans.

Related reading: VPN security and ZTNA, zero trust architecture, cloud security and shared responsibility, network segmentation and microsegmentation, DNS security.

Frequently asked questions

What is the difference between SASE and SSE? SASE combines both network (SD-WAN) and security components into a single cloud architecture. SSE is only the security side of SASE, meaning it includes components such as SWG, CASB, ZTNA and FWaaS but does not include a network component like SD-WAN. Most organizations start with SSE before changing their network infrastructure.

Does SASE replace VPN? Largely yes. The ZTNA component within SASE is designed to replace classic VPN. The difference is this: VPN connects the user to the whole network and opens a broad trust zone. ZTNA connects the user only to the application they need, with identity and context control. This fits the zero trust principle better.

Does a small organization need SASE? SASE primarily carries value for organizations with distributed users and many cloud applications. A small organization may not need the entire SASE architecture but can benefit from components such as the zero trust principle and ZTNA. The right start is not changing the whole architecture but closing the riskiest access paths with the zero trust principle.

Sources

To evaluate your remote access and network security architecture against the zero trust principle and plan a SASE or SSE transition, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.