Insight on the must-haves before embarking on Secure Access Service Edge. Find out more about it!
Must-haves Before Embarking On Secure Access Service Edge
SASE is the cloud-based access management service that makes it possible to manage users and provide secure access to corporate resources. It also enables companies to enforce security requirements, such as multifactor authentication and data encryption.
This is on all types of devices, including Windows, Mac, Android, iOS, and Linux. What are some tips to integrate SASE? Here are some must-haves when embarking on SASE:
Know Which Devices Users Will Access
The first step is knowing which devices you need to support. When you deploy SASE, you can create policies based on operating system type and device type. For example, you can require that all users use multifactor authentication with a hardware token or smart card.
This is by associating the policy with the device type for token-based authentication.
Enable Multifactor Authentication
SASE provides multifactor authentication in an easy-to-deploy solution that is integrated into your existing network environment. The solution offers a wide range of available options to meet your specific requirements for cost and complexity:
1. Verify the identity of users through one-time passwords generated on their smartphones. Also, in other devices such as mobile tokens or dongles.
2. Require users to present an additional form of identification. These are such as a smart card for physical access to the corporate network.
3. Require two forms of identification during user logon. This is such as a smart card and certificate for remote access via VPN or other remote protocols.
4. Use multifactor authentication in conjunction with a single sign-on (SSO) solution. This is such as that provided by Active Directory Federation Services (AD FS). And also this is for remote access via RDP or remote protocols such as Citrix ICA.
Encrypt All Data Transmitted Between SASE Client And Servers
Data encryption ensures that information cannot be accessed. This is by unauthorized users if it is intercepted in transit from the user’s device to the cloud service. The recommended encryption standard is 256-bit Advanced Encryption Standard (AES).
That is by using Cipher Block Chaining (CBC) mode with either SHA256 or SHA384 hashing algorithms. You should also verify encryption standards through an external audit service provider before deploying SASE globally. The following are some data protection considerations:
1. Store encrypted data only in an encrypted format.
2. Do not store decrypted data at any time after encryption.
3. Do not leave decrypted data in the cache for any amount of time.
Transport Layer Security (TLS)
You need to use TLS to encrypt data as it travels across the network. Since this will authenticate the identity of the SASE client. Also, it will authenticate the identity of the SASE server.
The Secure Socket Layer (SSL) will encrypt data as it travels across open, public networks. Then this SSL helps to authenticate the identity of the SASE server. For federated authentication, use AD FS or other SSO solution to provide a certificate that can be used to authenticate to SASE servers
What’s more, ensure that data is stored locally on users’ devices. Whenever possible, store data locally on users’ devices. This means that users’ devices will not have to communicate with servers to view or access information.
This is particularly helpful when users are traveling and are not connected to the internal network. Thus, using a hybrid approach enables you to set policies based on whether users’ devices are online or offline.