Your users don't stay in the office, and neither do their applications. Security Service Edge (SSE) is how you protect people wherever they work while still managing policy from one place. In this blog, we'll explain what SSE is, walk through its core components, and show how our managed Security Service Edge service deploys and runs Cisco's SSE tools for you.
The problem it solves is a familiar one. Laptops move between the office, home, airports and cafés, and most applications now live in the cloud. Sending all that traffic back through a head-office firewall is slow, and skipping the firewall isn't an option.
Gartner introduced the term in 2021 as the security half of SASE (Secure Access Service Edge). SASE combines SSE with SD-WAN networking; SSE is the part that inspects and controls the traffic.
Cisco delivers SSE in two forms. Cisco Secure Access is Cisco's SSE platform for any network, while Cisco Secure Connect is built for Meraki estates. Both grew out of the Cisco Umbrella portfolio, so if you've used Umbrella they'll feel familiar.
SSE is built from four core tools: firewall as a service (FWaaS), a secure web gateway (SWG), a cloud access security broker (CASB) and zero trust network access (ZTNA). Each solves a different part of the problem, and together they give one consistent policy for every user and location.
A cloud firewall sounds odd at first, but it makes sense. Your on-site firewall stays the first line of defence and tunnels traffic to the cloud firewall for deeper inspection. Remote users tunnel through the same service, so office and home users get the same rules, including blocking whole categories of harmful or unnecessary applications.
A secure web gateway terminates and proxies web traffic, so it can inspect encrypted sessions and stop threats before they reach the device. URL filtering, content filtering and file type controls are applied in one place for every user.
A CASB sits between users and the cloud applications they use. It gives you a central point to see which applications are in use and apply policy to them, limiting the risk those applications can bring into your network.
ZTNA starts with no access and grants only what a user and device need. Trust is established first, usually with multi-factor authentication (MFA) such as Cisco Duo, and then verified continuously as the user works rather than once at login.
It's one of nine service domains in our managed services, and it starts on the endpoint. We roll out Cisco Secure Client through your MDM platform, or manually where that suits. DNS-layer security then blocks malware, phishing and botnet domains, with application discovery and category filtering.
From there we manage access control, data protection and incident response policies, with real-time log monitoring. As your tier steps up, the service extends to the cloud firewall and secure web gateway, zero trust access with MFA, SSO and device posture checks, cloud VPN gateways for remote access, and data loss prevention (DLP) on data transfers.
Licensing comes first. We confirm you hold the right licences for what you need, whether that's Umbrella DNS or SIG Essentials or Advantage, Secure Connect Foundation or Complete, or Secure Access SIA (Secure Internet Access) and SPA (Secure Private Access).
The SSE service builds across three operational tiers, each including everything in the one before it. Essential covers the foundations during business hours, Advanced adds the cloud firewall and web gateway with extended hours, and Critical adds zero trust access, VPN, continuous analytics and DLP with 24x7x365 cover.
At Essential, we deploy Secure Client, manage access control and data protection policy, monitor events in real time and run Umbrella DNS protection.
Advanced adds the cloud firewall (firewall as a service) and the secure web gateway, with content, URL and file type controls.
Critical adds zero trust access, VPN as a service, continuous monitoring and analytics, and data loss prevention. It's built for mission-critical environments, with 24x7 incident response, a named Level 3 engineer and a named Customer Success Manager.
Pro-Tip: When you first switch on DNS-layer or web filtering, run the new policy in a log-only mode for a short period and review what it would have blocked. That surfaces the line-of-business sites and SaaS tools a strict category policy would break, before your users find them for you.
If you already run Meraki SD-WAN, Secure Connect pairs naturally with it. Together they effectively form SASE, with networking and security from one ecosystem, and our Meraki Security and SD-WAN service looks after the MX side.
Whichever you choose, the way we work is the same. Every engagement starts with a structured transition. Highlight gives you a live dashboard of device health and open incidents, the customer portal holds requests, changes and root-cause analyses, and in our co-managed model you keep full administrative access to your own environment.
SSE is a cloud-delivered set of security services, typically FWaaS, a secure web gateway, CASB and ZTNA, that protects users' access to the web, cloud and private applications wherever they work.
SASE combines SSE's security services with SD-WAN networking. SSE is the security half, and it can be deployed with or without SD-WAN.
Cisco Secure Access is Cisco's SSE platform for any network, and Cisco Secure Connect provides SSE for Meraki. Both build on Cisco Umbrella, with Cisco Secure Client on the endpoint.
No. Cisco Secure Connect suits Meraki estates, while Cisco Secure Access works with any network, including Catalyst and mixed environments. We deploy and manage either.
SSE gives every user the same protection, in the office or on the road, with policy managed from one place. Our managed Security Service Edge service deploys Secure Client, runs DNS-layer security and policy, and extends to the cloud firewall, web gateway, zero trust access and DLP as your tier steps up, on Cisco Umbrella, Secure Access or Secure Connect. The outcome is simple: your people, devices and data stay protected wherever work happens.
If you'd like to talk through how managed SSE could work for your users, start with our free 10-minute Build Your Business Case assessment for a recommended service tier and the value at stake, or check your wider posture with our free Security Assessment. You can also read the Security Service Edge service page, make an enquiry, or email us at sales@iptel.com.au.