What Agencies Should Know About Security Service Edge

Fallacy: SSE and SASE Are Different Names for the Same Thing

It’s easy to see why people might confuse SSE and secure access service edge. Both terms were coined by Gartner in just the past few years, and they’re closely related but not synonymous. The easiest way to distinguish them is to remember that the A in SASE stands for “access,” and that refers to SASE’s network access capabilities, such as software-defined WAN. SSE is essentially a scaled-down version of SASE that doesn’t include network access.

SSE is a subset of SASE; SSE focuses on security, while SASE focuses on both security and network access. SASE offers security benefits that SSE doesn’t because SASE provides a more complete picture of what’s going on.

Fact: SSE Is a Relatively New and Evolving Technology

The concept of SSE was first proposed in 2021. While the components of SSE aren’t new, unifying a combination of components is still evolving. There isn’t universal agreement yet as to what all the capabilities of SSE are.

The fundamental pieces are generally recognized as:

• Zero-trust network architectures, which provide stringent access control
• Secure web gateways, which perform content inspection and filtering for web browser–based activity
• Cloud access security brokers, which offer several security functions for Software as a Service applications

Many SSE technologies also include Firewall as a Service, and others include additional security functions within SSE. At this time, different SSE solutions may have significantly different capabilities.

LEARN MORE: These are the 5 keys to an effective cyber strategy.

Fact: SSE Provides Big Benefits Over Traditional Network Security

The adoption of mobile, cloud, IoT and other technologies as well as our increasingly distributed work environments have made traditional network security largely ineffective. Its primary benefit today is in protecting on-premises servers and equipment. For just about everything else, SSE can provide stronger security because it can monitor and analyze network activity regardless of where the users, devices, data and applications are. This enables SSE to find threats against many, if not most, government systems.

Without an SSE solution or any parts of SSE, operators are missing a lot of the security landscape. Unfortunately, that’s going to get worse, because agencies are likely to increase, not decrease, their usage of mobile, cloud, IoT and other technologies. If agencies don’t have SSE in place, they will continue to lose visibility and control over their security posture.

Fallacy: SSE Is the Only Security Solution Required

While SSE is quickly becoming indispensable, it’s not the only security solution agencies need. For example, SSE doesn’t provide many security controls for individual devices, other than some zero-trust capabilities. Officials still need anti-virus services, encryption for stored data, patch and configuration management, and so on. To look for signs of trouble and investigate incidents that occur, they also need technologies such as centralized log management; security information and event management; and security orchestration, automation and response.

And don’t forget that employees need training, with frequent refreshers, on avoiding social engineering attacks. Phishing is endemic, and technology can only do so much to prevent it. Teaching government workers and the public how to recognize and avoid social engineering is a good start, and conducting periodic phishing exercises is even better.

Click the banner below for the latest federal IT and cybersecurity insights.

Fact: It’s Important to Evaluate Both SSE Solutions and Providers

When admins seek SSE capabilities for their agency, be sure to evaluate both the SSE solution — the technologies — and the SSE provider responsible for operating and maintaining those technologies.

When vetting providers, look for a mature company that’s been offering cloud-based security solutions for at least several years. Ask about secure software development practices and supply chain safeguards, as attacks are increasingly entering environments from compromised vendor software.

To evaluate the SSE solution itself, there are at least three major considerations.

First, assess the quality of each SSE component in terms of performance, accuracy (such as false positives and false negatives) and usability.

Second, determine how tightly integrated all of the SSE components are with. Having a piecemeal collection of tools loosely thrown together behind an interface, with no deep integration or data sharing among the them, will weaken many of SSE’s promised benefits.

Third, many SSE adopters are choosing to implement SSE as a step — a big step — in implementing a full-fledged SASE solution. Agencies that are likely to move to SASE in the near future should be sure to look at the SASE solutions offered by SSE vendors and the migration path for moving from SSE to SASE.

UP NEXT: Agencies remain noncompliant with zero-trust requirements.