Recently coined by Gartner, Secure Access Service Edge (SASE) has been dominating Information Technology projects for both cost savings and needed pervasive security. This book provides a comprehensive foundational level understanding of what SASE is, how to leverage SASE for success, how to learn through each evolution, where to find more information, and what the future of integrated secure access solutions looks like.

We will begin this by introducing the concept of SASE for those who are still trying to clarify what SASE is or what it is not. In this chapter, we will cover how the market is defining SASE, what the actual market is for SASE, why we need to embrace SASE, and how to present SASE to your organization in a comprehensive manner.

In this chapter, we're going to cover the following main topics:

• Define SASE—what SASE is and what SASE is not
• Market SASE—a market evaluation of SASE
• Value SASE—value proposition, SASE services
• Embrace SASE—embracing the idea of a SASE framework
• Present SASE—presenting the idea of SASE and clearing the hype cycle

SASE is pronounced sassy. Andrew Lerner at Gartner coined the phrase in a blog post on December 23, 2019. That post can be found at https://blogs.gartner.com/andrew-lerner/2019/12/23/say-hello-sase-secure-access-service-edge/. He explains that Software-Defined Wide Area Network (SD-WAN) needed a security package. SD-WAN effectively replaces router-based WAN solutions in a next-generation software based package.

The SD-WAN solution varies from vendor to vendor but incorporates secure data forwarding with policies that leverage application specifications to guarantee the best handling of traffic for each application. This improves the User Experience (UX) as well as the network's resilience.

We now refer to SASE as a framework. SASE leverages multiple security services into a framework approach. Not all services offered as SASE solutions are required to be compliant, but adherence to a comprehensive security framework approach is expected. Currently, there is no SASE certification; instead, most of the SASE hype comes from intense competition through effective marketing.

The idea of SASE was not far from what security consultants were already doing by integrating multiple security solutions into a stack that ensured a comprehensive, layered, secure access solution. This approach is something I was already doing for my customers in ensuring Next-Generation Firewall (NGFW), Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and other necessary security solutions were a part of every SD-WAN installation. By calling it a SASE framework, the approach to a comprehensive solution somehow felt more focused than what the industry recognized as just a best security practice.

Commonly, SASE services include SD-WAN, Zero-Trust Network Access (ZTNA), Cloud Access Security Broker (CASB), NGFW, Secure Web Gateway (SWG), unified management, and orchestration. Just what constitutes a real SASE solution varies greatly by source. Several organizations, such as the Metro Ethernet Forum (MEF), are trying to establish neutral industry standards for SASE. These standards will pave the way for a universal understanding, the ability to integrate multiple manufacturers into a solution, and a method for teaching SASE.

Most network communications and security vendors have been working to create a full SASE framework under their brand. Their marketing presents the idea that a full SASE solution from a single vendor is the way to ensure security. Current customer feedback from the Fortune 500 class of NCE link" businesses is that two to three Original Equipment Manufacturer (OEM) vendors will need to be integrated to allow for best-of-breed solutions. This provides an opportunity for a Managed Service Provider (MSP) to give orchestration across multiple platforms to achieve optimal security.

To summarize, SASE is a new, next-generation secure communications services framework that combines many different services to close previous gaps in security. In the next section, we will define the market as it pertains to SASE services and solutions.

In the market today, a few different manufacturers offer self-proclaimed SASE products. The potential list of services across their portfolios that may be a part of a complete SASE service could be in the dozens, depending on their market approach. Calling a service SASE does not make it so, and as there is no SASE certification for solutions at the time of writing this book, no vendor or MSP is exclusively accurate in their marketing of what is or is not SASE. The standards for SASE have not been published at this time.

Gartner started a fire with that simple blog post in 2019. Overnight, every SD-WAN solution in the market offered a path to SASE. The SASE idea itself multiplied the SD-WAN market's potential revenue of over $11 billion United States Dollars (USD) by 2028. The global secure access service edge (SASE) market size is expected to reach $11.29 billion USD by 2028, registering a CAGR of 36.4%, a ResearchAndMarkets report reveals. The source of this quotation can be found at the following link: https://www.helpnetsecurity.com/2021/08/17/sase-market-2028/.

The reality is that an $11 billion-dollar market is only the core SASE product offering for the market. Hardware, software licensing, hosting, maintenance, and support make up the core products, whereas managed services and professional services can multiply the market impact by up to 25 times the core product revenue.

Market Challenge

The market challenge for realizing revenue potential will be primarily impacted negatively by a lack of skilled labor for design, build, and deploy services. This skills gap and the operational expenses preference of most Chief Information Officer/Chief Financial Officer (CIO/CFO) strategies will drive more than 70% of the market to contract SASE as a managed services offering. In the market, there is a trend of up to 78% of SD-WAN contracts leveraging managed services as opposed to utilizing in-house engineering teams. The primary reason for this change is not tied to SASE as CIO and CFO focus has been to rely on technical services as Operating Expense (OPEX) as opposed to Capital Expense (CAPEX). OPEX has been the goal for what is considered by an organization as non-business value cost. Generally, the CIO direction of the largest organizations is to convert operational support staff costs in order to leverage the cost savings on Software Development combined with IT Operations (DevOps) staff costs, which can offer a business Return On Investment (ROI). Support teams are a cost center, whereas the DevOps team can provide the potential to be a profit center to the company.

The complexity of SASE services is driving the need for technology engineering careers to move to a continual learning path. The time has passed where an engineer could rest on traditional education or certification paths. Traditional academic education can provide perspective, historical knowledge, foundational knowledge, and soft skills required for functioning in an organizational environment, whereas industry and manufacturing certifications provide core technical knowledge for functional understanding in a vertical role within an organization. Both educational methods are beneficial for building a foundational understanding of a skill set and both are effective filters when recruiting for a specific role. Unfortunately, neither can move at a market pace, which is today at an average of three DevOps or Software Development combined with Security and IT Operations (DevSecOps) sprint cycles from being out of date and ineffective.

Software development follows a continual improvement path, and so must its practitioners. The goal of the DevOps mentality is to leverage iterative development in a modular fashion as opposed to legacy, ground-up development and Go-To-Market (GTM) practices. DevOps practitioners continually develop, improve, and release. Scrum sprint cycles vary by organization, but an average of 2 weeks can be used as a model to understand the phases of development. New network and security software releases are no longer tied to hardware releases as they can function as a Virtual Machine (VM), Virtual Network (VNet) function, cloud-native function, application, or service independent of a platform. The entire GTM process could be as little as one Scrum sprint cycle or 2 weeks. Network and security practitioners operate on a New -1 ( N-1) basis, N-1+validated, or wait for a triggering event to validate a new software release. The market average for consumption of new software releases is moving to an average of three sub-versions of code, which could average 6 weeks between the last production upgrade of software and the next production upgrade.

The market has been slow to admit that network or security engineering is no longer a discrete skill set from software development. In fact, SASE services will receive major software updates every 2 to 6 weeks, depending on the development cycle or security issues with each independent SASE service within the overall solution. Minor updates may occur in real time. Education for engineering teams must align with software release cycles.

In summary, the market's perception of SASE varies according to the beholder's skill set. As a result of rapid product development, the market for SASE is likely to grow exponentially, creating the issue of rapid evolution that needs to be managed. The next section clarifies the value proposition of a SASE framework for secure communication solutions.

Effective security is inherently valuable, but how do we accurately estimate that value? How do we quantify the value of a solution for an unknown risk impact? Former President of the US, Ronald Reagan, was quoted as saying: "Information is the oxygen of the modern time. It seeps through the walls topped by barbed wire; it wafts across the electrified borders." If information is oxygen, what is the accurate value of oxygen to human life? Effective security pays for itself in reducing risk, liability, and loss of unknown quantities by protecting that oxygen or—in this case—non-public information.

To evaluate SASE in a value proposition or ROI, the investment should be first quantified. Steven Ross, Executive Principal of Risk Masters Inc., points to the Return on Security Investment (ROSI), which is a calculable assessment as a way of identifying the monetary value of the security investment. This may be important to the CFO or investors as a model for understanding financially the inherent value of secure IT investments. More information can be found at the following link: https://www.isaca.org/resources/isaca-journal/past-issues/2011/what-is-the-value-of-security#1.

Without effective security solutions, an organization will cease to achieve a primary ROI for time and capital invested. A recommended value proposition for security is the ability to conduct, without obstruction, the primary business of the organization on whose behalf the secure solution is employed. SASE provides cost-effective security and builds value by reducing inefficiencies in previously developed generations of secure communications. Cost reductions can be achieved by reducing labor, time, capital, focus, outages, performance issues, and educational requirements for staff members trying to build their own perfect technology. Simply speaking, the investment required to develop secure technology solutions in-house with homegrown or best-of-breed market solutions has been providing a negative ROI, which has driven the market to leverage an MSP that specializes in a specific technology. This method also allows for the transfer of liability to the MSP, which provides some relief for executives not choosing to develop their own secure communications solution in-house.

Leveraging SASE with SD-WAN prepares networking and security solutions for a future of automated and secure IT provisioning with real-time operations remediation. To eliminate the inefficiencies that every network has experienced, the solution starts with abstracted components and the disaggregation of data and control-plane activity (separating components). By leveraging a deconstructive process, smaller changes may be made, reducing the risk of any one change causing a major impact to secure network communications. The smaller the change, the quicker the change can provide business value. The target process is analogous to a garden-pruning process that makes small changes until the overall desired effect is achieved. Unlike physical garden pruning, small changes in SASE can be reversed quickly if a negative outcome is realized. Overall, this methodology allows IT organizations to move much quickly than we could even 5 years ago, which allows us to do more with less at the pace of the market.

Orchestration allows for solutions to be templated. The orchestrator allows templates to be overlain upon any of the logical components in the overall solution or service. The creation of a template-based design offers rapid deployment across the abstracted solution. An additional benefit of orchestration is that template continuity may be enforced by the orchestrator and any variance in behavior be reported to security operations systems for tracking and mitigation. This process allows the achievement of compliance with approved network or security designs and immediately identifies violations for action.

SASE provides value in efficiencies, scale, automation, enforcement, and orchestration over similar secure communications technologies in production today. The overall value reduces the design, build, deploy, and operate labor required to keep an organization communicating securely.

Overall, the value of a SASE solution lies in its ability to reduce productivity losses caused by security risks or threats. SASE integrates independent security solutions for a holistic approach that can be automated, reducing the amount of human labor required while taming a mission that was once near impossible.

In the following section, I hope that you will learn to embrace SASE for the inherent benefits it provides to your organization.

SD-WAN adoption was extremely slow from inception and into 2021. The main reason for the slow adoption was due to a lack of education prior to intense market demand, based on inflated cost-savings estimates over Multiprotocol Label Switching (MPLS) and other legacy network types. Gartner defined the Gartner Hype Cycle as a method for evaluating when to leverage a New-to-Market (NTM) technology. In their five phases, they identify levels of understanding a shiny new market idea prior to consumption. The benefit of this approach is that it gives the perspective necessary to make an educated decision. More information is available at the following link: https://www.gartner.com/en/research/methodologies/gartner-hype-cycle.

Educated decisions require available educational material, which doesn't materialize in the market until the Trough of Disillusionment. Phase three is roughly where the lessons learned are documented and an effective curriculum is developed, allowing training to start. At the time of writing this book, the Hype Cycle for SASE is still effectively in phase one, where there is much more excitement than factual data.

The promise of SASE is tied to the value; faster, easier, more secure, more automation, and rapid deployment. Better, faster, and cheaper is the market's battle cry. A well-designed SASE can deliver on all these when paired with the right resources. The correct mindset is that security is done in layers, and the best security leverages as many layers as is productionally sound. The best security does not come from a product but through best-practice frameworks implemented correctly. The qualified resource can come from networking, security, or software backgrounds, but is the continually self-educating resource that is concerned about being right for the sake of those served, as opposed to being right for the sake of righteousness. There is no silver bullet for solving the resource/ market/skills gap; however, the right resources will self-educate perpetually, allowing themselves to be wrong in knowledge so that they can remediate their gap and their solution will be right in production.

In conclusion, SASE helps organizations reduce their ongoing labor investments in security operations after initial design and implementation. While embracing SASE will take a significant investment of time, it will provide significant returns.

The next section will provide you with an outline for a comprehensive presentation on SASE that can be tailored to your target audience.

Presenting SASE to executive, administrative, or technical audiences requires a framework for discussion, of which a sample is provided in the following list of items, with a key understanding of each topic that may be further detailed or placed into a slide format with speaker notes:

1. Introduction:
   • SASE is pronounced sassy.
   • Gartner defined the term to describe what was happening in the market.
   • SASE services may include SD-WAN, ZTNA, CASB, NGFW, SWG, as well as other services.
2. From Framework to Managed Service:
   • The SASE framework provides for the integration of solutions from multiple vendors.
   • The market is buying SASE services on a consumption basis.
   • Most organizations will leverage two to three SASE vendors and one MSP.
3. SASE Managed Service:
   • This effective managed service offering allows for OPEX instead of CAPEX.
   • Managed services are being consumed for SASE due to rapid software development ahead of effective education for engineering or operations staff.
   • The right managed service offering provides orchestration, open Application Programming Interface (API) integration, Artificial Intelligence for IT Operations (AIOps), and multivendor seamless integration.
4. SASE Service Stakeholders:
   • For secure, compliant, resilient, and high-performing solutions, a framework for feedback and participation in business-impacting decisions is required.
   • Stakeholders may be defined leveraging Project Management Institute-Project Management Professional (PMI-PMP) best practice.
   • Governance is required.
5. Actors and the Managed Service:
   • SASE defines subject actors, target actors, and the role MSPs play.
   • A subscriber contracts a service for the actor's benefit.
   • The managed service must provide layers of security that account for real-time access to zero trust.
6. Identity, Context, Situation:
   • Identity, as in who or what is authorized by the service.
   • Situation builds upon the context for the access role and further defines access.
7. SASE Sessions:
   • Sessions are the heart of SASE and may be considered as a wrapper for network sessions.
   • Sessions incorporate application-specific policies.
   • Sessions leverage the zero-trust framework as well as SD-WAN.
8. SASE Security:
   • Security is not a product but builds effective layers upon a secure foundation.
   • DevSecOps and DevOps necessitate production software code updates as often as every 2 weeks.
   • SASE will require integration across vendors for best-of-breed capabilities.
9. SASE Policies:
   • Legacy firewall or router policies force specific behaviors that are not sensitive to external changes in the factors by which that policy was written.
   • Automation and orchestration allow policies to be changed based on real-time conditions.
   • Effective SASE policy considers all available data in the decision process.
10. SASE Connectivity:
    • Most commonly, SASE connectivity will come from SD-WAN.
    • SD-WAN allows SASE to leverage quality, performance, and application-awareness tools.
    • Remote access solutions, Fifth-Generation Cellular (5G) services, satellite services, Ethernet circuits, and legacy WANs may be incorporated into SASE.
11. SASE Services Use Csases:
    • The primary SASE use case is SD-WAN plus security.
    • SASE may be leveraged for both cloud infrastructure and applications.
    • SASE can be used to create on-demand, secure communications across any network type.
12. Looking Forward:
    • The future is SASE, as it is possibly the last step in the pure cloud transformation journey that all organizations must take.
    • AIOps with SASE allows for consistent, reliable, secure, and on-demand application access.
    • SASE education must follow the continual learning, continual improvement path for staff.

Presenting SASE requires a balance between the past, present, and future, as well as between many independent technology focus areas. This outline provided a framework for bringing the entire audience into a SASE mindset, regardless of skill set. 

In this chapter, we've provided an overview of SASE with a definition of it, as well as the original concept that was coined by Gartner. We evaluated the market for SASE services. SASE's value was discussed, as well as the importance of embracing SASE to obtain returns on security investments. Toward the end of the chapter, we offered an outline by which SASE can be presented as a whole concept to an audience.

In the next chapter, we will be covering SASE as it relates to the Human element. We will cover the Issue, Problem, Behaviors, Solution, and Pattern of Humans in the SASE world. The SASE Human chapter will help leaders form thought leadership as it relates to their staff and SASE programs for their organization.