SASE, FWaaS and Zero Trust: plan networking and security operations together

Turn the terminology into a shared target architecture

Secure Access Service Edge (SASE) combines networking capabilities such as SD-WAN with cloud-delivered security services. Security Service Edge (SSE) describes the security layer, including secure web gateway, firewall-as-a-service (FWaaS), cloud access security broker and Zero Trust Network Access (ZTNA). The useful capabilities depend on the use case.

Start by establishing which people, devices and sites need access to which applications. This overview provides a basis for extending the existing network and security architecture where required.

Zero Trust starts with identity and access

NIST describes an approach where network location or device ownership alone does not establish trust. Authentication and authorisation take place before access to a resource. This shifts planning towards identities, devices and the application being accessed.

For selection, this means limiting access to what is needed, considering available context signals and reviewing changes transparently. ZTNA can support application-specific access. A single product does not replace coordination of permissions, devices and operating processes.

FWaaS and SD-WAN need explicit traffic paths

FWaaS provides firewall capabilities as a cloud service. SD-WAN can direct site traffic to suitable security services. The architecture needs to establish where traffic is inspected and which tasks remain with local firewalls.

During the pilot, examine critical applications, routing, latency and behaviour when an access link or security service fails. Cloud entry points, encrypted connections and exceptions need to fit the site structure. The SASE label alone does not establish a binding set of features or service levels.

Managed security defines how operations work

Central policies still leave alerts, updates and incident decisions to be handled. Define who maintains configurations, assesses events and authorises responses. Managed security can complement internal IT where the agreed service scope covers these tasks.

For a SOC or MDR model, the service description should specify the systems monitored, handling hours, escalation paths and response permissions. TM-Connect structures requirements and coordinates discussions with suitable specialist partners.

• assign ownership of networking, identities and security policies
• agree log scope and access, and the necessary privacy review
• connect outages and security incidents with appropriate escalation paths

Use a focused pilot to assess the architecture

Start with a manageable group of sites, users and applications. Record current behaviour and the improvements you want to assess. Then validate access policies, application use, failover and a security-incident process with the responsible teams.

TM-Connect helps assess connectivity, security and operations, compares suitable solution paths and coordinates implementation. The platform, availability and division of responsibilities are reviewed for the individual project.