SASE is basically networking and security coming together as a massively-distributed Cloud service.
We're speaking with Anand Oswal from Palo Alto Networks about
SASE, which brings together networking and security. Hey, Anand. How are you today?
I've been great, Michael. How are you? Good. Anand, we hear this term
SASE all the time. What does it mean? SASE is Secure Access Service Edge.
But before I tell you what is SASE, let me just rewind the clock a little bit.
If you rewind the clock 20 years ago, security was mainly bolted onto networking products like
a router. That solved certain problems from a layer 3 perspective. But soon,
as more and more complexity was added to the network and applications,
that layer 3 router wasn't enough. Then we had a next-generation firewall.
That's intrusion detection and prevention. But then we also had point products to solve
particular secular use cases. We had URL filtering appliances. We had
appliances that did sandboxing for malware. And so, now we had this proliferation of these point
products along with a next-generation firewall. This led to more and more complexity for our
enterprises. What we really need is a platform approach, a single platform
that can secure all users accessing any application and any data sitting anywhere.
SASE is really networking and security coming together as a unified, massively- scalable
Cloud service. That's what SASE means in a very simplistic manner.
Consuming networking and security as a service, ensuring optimal and best user experience
for any user accessing any application on any data sitting anywhere or any network.
It sounds like it's tailormade for our hybrid working,
work from home, work from anywhere environment. If you think about the last 24 months or so in the
pandemic, the two things that have accelerated the most are, of course, remote work—we're all working
remotely or in a hybrid fashion now—and applications accelerating to the Cloud.
These two are massive transformations that have happened in a very accelerated pace.
With SASE, we're ensuring that organizations can scale. Organizations can have more agility.
They can consume both networking and security as a Cloud-delivered service. They can have consistent,
best-in-class networking and security with optimal user experience.
How does SASE deliver or create these kinds of benefits?
What SASE allows us to do is have both networking and security delivered as a service
(very simplified) so organizations can focus on what they do best and consume this service. At
the same, they have an optimal user experience. So, if I'm in the home, I'm in the branch office,
or I'm on the go in a café shop, I have the same optimized user experience
and the highest level of security experience. Anand, what are the components of SASE?
SASE was coined by Gartner in 2019. SASE has five key constructs: next-generation SD-WAN,
zero-trust network access, secure Web gateway,
firewall as a service, and Cloud Access Security Broker. All of these five components come together
seamlessly delivered as a unified Cloud service that is massively scalable.
Are there any risks associated with this type of convergence, bringing these pieces together?
There are only advantages with this in terms of the way organizations can accelerate
their transformation, accelerate network transformation, accelerate Cloud transformation,
and accelerate the transformation of a hybrid workforce because users are everywhere.
Applications today are no longer only in your data center. They're in your data center,
but they're in the Cloud. They're in multiple public clouds. They're SaaS applications.
Users, we are everywhere. If you think about it, in the past when you were home accessing
applications remotely, sometimes you weren't able to access a certain set of applications.
That can no longer happen today when the workforce is hybrid and remote. You want
to access all the applications from any location and have the best user experience.
You want the security administrator to understand exactly what's happening. Who is accessing this
application? Do I have the right permissions? Am I accessing the right data? Where is the data
residing? Do you have the right compliance, are regulatory conditions met, et cetera?
Can you give us an example from any particular industry to illustrate
how SASE supports business agility? We have a large healthcare organization,
100,000+ workers. As you know, in the pandemic, everybody was working remotely. At the same time,
you did have doctors and nurses in the hospitals. How do you ensure that you have new processes,
for example, for the check-in of patients? Having doctors talking to patients remotely,
ensuring that you can still have continuity. We worked with a large fast-food chain restaurant
that now had to change some of their practices. From users pointing to what they want in the food,
they're able to use them through an app, deliver them seamlessly, and transform their business.
We have large professional organizations with over a quarter of a million users
overnight working remotely and ensuring that they're able to manage all their applications, all
their users, and had the right level of visibility and granular controls for the entire organization.
Numerous such examples across every single vertical.
Given these examples, how does SASE make all of this possible, especially in contrast to the way
security and networking was handled in the past? The key construct here is that when you consume
things from the Cloud as a service, you're able to scale at an extremely rapid pace.
Many of our customers had to go from partial hybrid or no hybrid workers in the past,
overnight, to 100% of their workforce working remotely with a light on our
SASE solution to ensure that they have networking and security delivered to the user as a service.
They're able to get all the users up and running. They're able to have their businesses
continue to operate the way they have, to ensure that the applications
get data as secure. It enabled all their workers to be productive, to have secure access
to applications, to data, and be productive. What about the timeframe to deploy? If you
have a SASE environment, what kind of time is required to make the configuration changes
that are necessary if you have something like a pandemic and, suddenly, the
workforce needs to change in some significant way? We had some of our customers, overnight, move from
a small number of remote workers to close to a quarter of a million remote workers over a
weekend. When you consume some things from the Cloud-as-a-Service, when you have a scalable
service like we have at Prima SASE, you're able to accelerate the pace at which you can move.
That's a big part of it then is the speed of being able to make changes.
Deploying this service at a very fast pace, which is easy for us to deploy. At the same time, having
all the levels of monitoring, visibility, and control that you want to do on an ongoing basis
for your users, for your applications, for your data to ensure they're all secure.
Anand, you've been describing (at a high level) what SASE is, what it does, the benefits.
Can you drill down a little bit and tell us about the components? What kind of hardware or software
needs to be in place in order to implement SASE? If you think of SASE, I talked about
SASE as basically networking and security coming together as a massively-distributed Cloud service.
You can think of it in three different aspects. • The first aspect is securing remote workers.
• Then you can think of SASE for branches. There you will always have an SD-WAN appliance because
you will have an appliance connecting to some service in the Cloud. You also have that appliance
providing some level of security for east-west traffic, what we call a zone-based firewall.
• Third is that we'll have components of digital experience management.
What I mean by that is how do you ensure that, from the user to the application,
and every single segment of the network, you had the right visibility into what's happening.
It's the flexibility and the agility that's the common thread here when
you bring together security and networking. Also, the consistency. You want to make sure
that you have consistent security, the best security, but consistent security.
Let's talk for a second about zero-trust security. Where does that fit in?
Zero trust assumes that you have no notion of implied trust for the user, for the application,
and the data. We talked about the fact that you need four key constructs for zero trust.
• Ensuring that you understand who the user is and authenticate the user, dual-factor
authentication through some identity mechanism. • You understand the device they're accessing
it from. Is it the right device? Does that device have malware?
• Then you want to ensure, can you access the application or data?
Do you have permission to access that application or data and what you can do with that data?
• The fourth is the transaction. When you're sending data, does it have malware?
And do that on a continuous basis. With SASE, when you're bringing
networking and security together, we need to ensure that is done in a zero-trust fashion,
which means that there is no notion of implied trust. I'm ensuring that I have the best access
to the network. I'm ensuring that I have all components of security. The firewall as a service,
zero-trust network access, secure Web gateway: all of those constructs are available for SASE.
Now, what about multi-Cloud scenarios? We are living in a true multi-Cloud environment.
Eighty to eighty-five percent of all organizations have applications in more than one Cloud.
That's just the reality, right? That's why when I talked about SASE connecting users to applications
in the private data center, in multiple clouds, or SaaS applications.
Those users are also everywhere. We want to ensure that we're able to seamlessly connect these,
any users to any applications over any network securely. At the same time, you want
to have consistent security and consistent user experience no matter where you are.
Now, if we can shift slightly and talk about networking dimensions and SD-WAN,
which you've referred to quite a number of times. The first versions of SD-WAN were mainly built
(if you think about it) from the perspective of you had your leased lines or MPLS lines,
you had broadband, and many organizations made decisions for cost arbitrage.
What we are seeing today are customers augmenting broadband to MPLS. But more important drivers for
SD-WAN is Cloud transformation, is network transformation, is optimal user experience
because you want to access the application in the best possible path from where you are.
If you're in the branch, you want to access the application directly
from that branch. You don't want to go from the branch
to the headquarters and data center, from there to the application sitting in the public Cloud
or SaaS applications or a local data center. You want to optimize the optimal path for that.
That's where you get the whole notion of next-generation SD-WAN, which is not packet-based.
It's based on layer 7 constructs. You have application awareness baked into
that. At the same time, you have all notions of application and user monitoring available.
Let's talk about the implementation of SASE and the migration from an existing
network and an existing security environment. There are many ways to transform your network to
a complete SASE network. Different organizations have taken different approaches to it.
In the pandemic, you have many organizations who move through a completely remote work environment.
All organized moved. Many of them optimized for having security for their remote workers from home
with our offering from SASE, which enabled them to have an agent on their end device accessing
applications in the Cloud, full security provided to us through our offerings of Prisma SASE.
At the same time, now, as the pandemic is trying to ease, we have many organizations opening up
their branches. When they start doing network transformation,
it's happening from their SD-WAN appliance, connecting it directly to our offering in
the Cloud for a complete SASE solution, bringing the SD-WAN constructs and our constructs around
Cloud-delivered security together. Then organizations are layering in
notions of digital experience management to ensure that they have the right level of monitoring
capabilities, the right level of insights, the right level of analytics, ensuring that the bits
and bytes of data on the network are converted to information. That information into insights
leads to outcomes for them. So, they're ensuring that they're able to add that capability
to have a complete end-to-end SASE offering. Is SASE a pure technology solution or does
an organization need to make process changes along the way?
SASE is bringing together networking and security as a massively-distributed Cloud service,
which also means that, in many organizations, networking and security could be different
personnel, different departments, which requires coordination, which requires them to bring
people together to ensure that they are having the right outcomes for the organization.
Absolutely, that's happening as well. In some respects then this SASE environment
is going to be simpler to operate than all of these disparate systems.
Absolutely. SASE will be a very simplified offering given that you are bringing
networking and security together, operating as a Cloud service. It's massively scalable so, as you
expand your organization, as you add new branches or new sites, you can easily scale that notion.
Second, you can ensure that you have consistent security. You don't need to worry about having
disjointed security practices, different for branches, for different users, et cetera.
Third, you're able to ensure that you have all notions of digital experience management,
which means from user to application, end-to-end. You have insights, visibility,
and automated remediation for the entire network. Anand, what advice do you have for CIOs, network
folks, or security folks who are listening and they want to adopt SASE? How do they go about it?
First and foremost to keep in mind is that networking and security are
coming together faster than ever before. The second is that you have two massive
transformations happening in the industry. One is a hybrid workforce and the second is
applications moving to the Cloud, to multiple clouds, to SaaS applications. At the same time,
there's an application in the data center, so we're truly living in a multi-Cloud world.
We want to optimize any user accessing any application and data over any network. We
want to make sure that it is secure, the best in class security, you have consistent security
no matter where you are or who you are. You start with ensuring that all your remote workers are on
the SASE umbrella, if I may call it, ensuring that they have the best in class security
consumed as a service (networking and security), optimized digital experience management.
Then you start transformation on your branch environments as you are going with SD-WAN
and Cloud-delivered security. Again, add the layers of digital experience management to ensure
you have visibility, monitoring, and insights. When all of this comes together, you
have an end-to-end SASE network, which means your remote workers, people in café shops,
people at home, people in the branches, all of them have consistent, best-in-class,
Cloud-delivered networking and security. What are some of the pitfalls that companies may
fall into or the risks that they should avoid, again, as they're going through this process?
The biggest risk that organizations have is having disjointed security solutions. I mean
that you have a security solution when your users are in the branch or in the headquarters accessing
applications in the data center and the Cloud. You have a different, disjointed security offering
when you're having the same for accessing applications in the Cloud. You have a third
different solution if you're accessing it remotely from home when accessing applications in the Cloud
or then applications in the data center. You want to have a unified offering, and
that's why a platform approach is so important. Anand, as we finish up, where is all of this
going? In other words, what are your customers telling you that they want?
Every single customer I talk to is accelerating their transformation to the Cloud.
At the same time, it's a journey for them. Not every single application that they have
is sitting in the Cloud. There are still applications in the data center, and there
are still applications in multiple clouds (like you said before). Then you have SaaS applications.
At the same time, everybody realizes that the future of workforce is hybrid. We'll have people
at home. We'll have people in the office. You want to have optimal, best-in-class
security with no notion of implied trust. You want to have optimal and best user experience
no matter where you are. And you want to have secure access to all your applications, to all
the data no matter where they reside. That is key in terms of how CIOs are thinking about it today.
SASE is the foundation for the way we're working today, the way everybody is working today.
SASE will help them ensure that any user (no matter where they are), any application can
be accessed securely over any network. Then you layer in all the constructs of having visibility,
monitoring, insights, all through a single dashboard for all of networking and security.
Anand Oswal, thank you so much for teaching us about SASE today.
Thank you, Michael.