# SASE Architecture: Converging Networking and Security at the Edge
The castle and moat security model assumed everything important lived inside the perimeter. Firewalls guarded the gates. VPNs created tunnels for authorised entry. Inside was trusted. Outside was not.
This model collapsed when workers went home and applications moved to the cloud. The perimeter dissolved. Users connect from anywhere to applications hosted everywhere. Backhauling traffic through data centres for security inspection adds latency and cost without providing effective protection.
SASE, Secure Access Service Edge, reconceives the architecture. It converges networking and security capabilities into cloud delivered service. Users and branch offices connect to nearby SASE points of presence. Security applies at the edge rather than forcing traffic through central locations.
## Understanding SASE Components
SASE combines multiple capabilities into unified architecture. Understanding the components clarifies the overall design.
**SD-WAN** provides the networking foundation. Software defined wide area networking optimises connectivity across multiple transport links. Internet, MPLS, LTE, whatever is available. Intelligent routing chooses the best path for each application.
**Secure Web Gateway** inspects and controls web traffic. URL filtering blocks malicious sites. SSL inspection examines encrypted traffic. Data loss prevention catches sensitive information leaving. These protections follow users everywhere.
**Cloud Access Security Broker** extends control to SaaS applications. Visibility into cloud service usage. Control over data sharing. Compliance enforcement for regulated data. Shadow IT becomes visible and manageable.
**Zero Trust Network Access** replaces traditional VPN. Users authenticate to access specific applications rather than network segments. Continuous verification rather than one time authentication. Least privilege access based on identity and context.
**Firewall as a Service** delivers network security from the cloud. Stateful inspection, intrusion prevention, and advanced threat protection. Applied at edge locations near users rather than requiring backhauled traffic.
## Why SASE Now
Several trends converged to make SASE compelling. Understanding these drivers helps evaluate relevance for your organisation.
Remote work became mainstream. When users work from anywhere, security must follow. Backhauling home worker traffic through corporate data centres creates terrible experience. Users bypass VPN because it is slow. Security suffers.
Application migration to cloud continues. SaaS applications dominate productivity workloads. Cloud infrastructure hosts internal applications. The data centre no longer hosts most of what users access. Network architecture should reflect this reality.
Network costs frustrate IT leaders. MPLS circuits are expensive and slow to provision. Internet connectivity costs a fraction with comparable performance. SD-WAN enables using cheaper transport without sacrificing reliability.
Security complexity overwhelms teams. Multiple point products create management burden. Integration gaps leave coverage holes. Consolidated platforms reduce complexity while improving protection.
## Architectural Principles
SASE architecture follows principles that differ from traditional approaches.
**Identity centric security** replaces network centric models. Authentication and authorisation determine access, not source network location. Users have the same experience and security whether in the office or at home.
**Cloud delivered services** eliminate infrastructure sprawl. Rather than hardware at every location, centralised services scale automatically. Updates deploy everywhere simultaneously. New capabilities roll out without hardware refresh.
**Edge enforcement** reduces latency. Security inspection happens at points of presence near users. Traffic does not backhaul through distant data centres. Application performance improves because paths are direct.
**Unified policy** simplifies management. Single console controls all security functions. Consistent policy applies regardless of how users connect. No gaps between different products from different vendors.
## Implementation Considerations
Deploying SASE involves significant architectural change. Thoughtful planning enables successful transition.
Current state assessment identifies what exists. Document network topology, security controls, and traffic patterns. Understand where users connect from and what they access. This baseline informs migration planning.
Vendor selection requires careful evaluation. The SASE market includes both specialists and platform vendors. Feature completeness, performance, integration capabilities, and roadmap all matter. Proof of concept testing validates claims.
Migration strategy should be incremental. Big bang transitions create excessive risk. Phased rollout enables learning and adjustment. Start with specific use cases or locations before expanding.
If your organisation is evaluating SASE architecture or needs help with network security transformation, contact us through our contact page. We help businesses implement modern network security that protects distributed workforces.