Insight on the best framework that helps organizations build secure systems. What is SASE architecture?
What Is SASE Architecture?
SASE Architecture is a security architecture framework that helps organizations to build secure systems. The framework provides a set of design principles and guidelines. It can be used to develop high-quality security architectures.
SASE architecture is developed by the Center for Internet Security (CIS). CIS is an international nonprofit organization founded in 2002 to facilitate the adoption of standards-based security controls. The SASE framework was developed in 2011 and has been improved upon since then.
This framework is based on four primary components. These are Secure configuration, asset management, secure operations and assurance, and secure development and acquisition.
SASE Architecture Framework
The SASE Architecture Framework consists of 12 security assurance domains and 57 security controls. So, the SASE architecture was developed to provide a common language for organizing information about IT security controls. This is as well as a common set of architectural principles for designing secure systems.
It allows organizations to build secure systems that are consistent with industry best practices. To develop a secure system using the SASE framework, an organization should implement all 57 controls in the following 12 assurance domains.
SASE Framework – Security Assurance Domains
Each domain comprises several subdomains. These domains are:
SASE Footprint
The SASE footprint is a diagram that can be used to determine whether all 57 security controls are implemented in an organization’s systems. So, the SASE footprint is available for download from the CIS website. It contains a matrix of the 57 security controls across 12 assurance domains.
Security Controls Matrix
The Security Controls Matrix contains a list of all 57 security controls. This matrix can also be downloaded from the CIS website.
Security Controls Catalog
The Security Controls Catalog provides detailed descriptions of each security control. This includes how it addresses a particular aspect of information security. Also, on resource information on how to implement each control.
Security Control Documentation
Security control documentation, such as design documents and checklists, should be developed and be available to implementers. So, this is who needs to ensure they have implemented controls correctly. Also, a sample design document is available on the CIS website.
It provides detailed information on how to develop a documentation package for each security control.
CIS Benchmarks
The Center for Internet Security publishes several industry-recognized benchmark tools and software packages. Also, it can be used with the SASE framework to assess security controls within an organization’s systems and infrastructure. So, these tools are CCTL (Cybersecurity Controls Testing Laboratory), Benchmarking Toolkit for Information Technology Systems, Benchmarking Toolkit for Cybersecurity Operations, and Benchmarking Toolkit for Cybersecurity Education.
Security Assessment Reports
A security assessment report should be produced when an assessment is performed. Also, it should include findings, recommendations, and remediation actions to address any issues that were uncovered during the assessment process. So, Sample security assessment reports for each assurance domain are available on the CIS website.
So, a report template is also provided to help organizations produce high-quality assessment reports.