Diving into Secure Access Service Edge: A technical leadership guide to achieving success with SASE at market speed

BIRMINGHAM—MUMBAI

Diving into Secure Access Service Edge

Copyright © 2022 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Associate Group Product Manager: Mohd Riyan Khan

Publishing Product Manager: Shrilekha Malpani

Senior Editor: Shazeen Iqbal

Senior Content Development Editor: Adrija Mitra

Technical Editor: Nithik Cheruvakodan

Copy Editor: Safis Editing

Book Project Manager: Neil D’mello

Proofreader: Safis Editing

Indexer: Subalakshmi Govindhan

Production Designer: Alishon Mendonca

Marketing Coordinator: Ankita Bhonsle

First published: November 2022

Production reference: 1141022

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham

B3 2PB, UK.

978-1-80324-217-0

www.packt.com

To my mother, Rachel Ginn, who taught me that every problem can be solved with hard work, kindness, and a genuine relationship with Jesus Christ.

– Jeremiah Ginn

Foreword

I had the privilege of meeting and working closely with Jeremiah Ginn in the successful deployment of a large SD-WAN solution for a top-tier AT&T customer. His forward-looking and thinking are unparalleled in this industry, and his leadership in the development process was exactly what we required to get this huge success. Jeremiah spends his time investing heavily in people both within the workplace and with his passions outside of the work environment.

Secure Access Service Edge (SASE) is one of the most widely used acronyms in the digital realm of all businesses and industries today. CEOs desire to understand it, CTOs desire to implement it, and security and network executives are working to deploy it. At the same time, engineering management and staff are actively creating lab scenarios and preparing for the upcoming shift they see coming at them. This book is directed at both those looking to be involved in SASE and those already heading down the path of SASE deployment.

Jeremiah is one of the leading and likely the most pervasive voices in the definition, design, and success of SASE. In this book, Jeremiah reveals the detailed success criteria necessary to meet the new level of challenges SASE creates, including the substantial executive support required and the paradigm shift in the training, implementation, maintenance, and support.

David H. Brown

Principal Architect at AT&T

Contributors

About the author

Jeremiah Ginn is a husband, father, teacher, engineer, architect, author, Cybersecurity Evangelist, children's advocate, advocate of Military Veterans and their families, and Service-Disabled Veteran who proudly served in the US Army. He currently has 11 children 3 biological, 6 adopted, and 2 in guardianship. Leading SDN evangelism efforts across many global organizations, his recent experience is in SD-WAN, SASE, NFV, multi-tenant cloud edge compute, and network infrastructure architecture, helping more than 3,000 organizations over the past 25 years. He contributes to the development of SDN, SD-WAN, and SASE solutions at AT&T. He is an IEEE member and contributes to The MEF Forum's W117 SASE Service Attributes and Service Framework.

Thank you to everyone that invested in me and my career. You know who you are! Thank you Meredith Ginn for the privilege of your hand in marriage for almost three decades. In five more decades, we should know enough about marriage to make an educated decision, but until then, I am happy to hold your hand. I love all of my children, regardless of how they came into my life, and regardless of what document signifies our relationship.

This is a technical book, a life book, an education book, a perspective book, and a lessons learned book. Thank you to David Brown, my technical reviewer and friend. Without David, this book could not have offered long-term value to those of us who learned engineering the old way.

Thank you to my team at Packt, who have worked incredibly hard to get this book to you. They probably all still have concerns about my approach to teaching as I am sure you will, but I hope this book helps you, your team, and your organization achieve the success that you truly deserve! Thank you for investing your personal time into reading this book as I wrote it to invest in you, the reader. May you be a perpetual learner and invest in other humans.

About the reviewer

David H. Brown is a Principal Architect at AT&T with decades of experience developing, managing, deploying, consulting and selling leading edge technologies to private and public companies. His professional experience as a trusted advisor has focused on enterprise solutions, deployment of information systems, and technology integration solutions for enterprise and government.

Previous to AT&T, David was a Principal Architect for VeriSign and has many years of experience working for small and large corporations and government organizations in full-time and consulting roles.

David holds multiple certifications, including CCIE #6231, CISSP #28504, GSEC #42081, and GCED #2487, and he also earned a master’s degree (MBA) from McColl School at Queens University of Charlotte and a bachelor’s degree in Computer Science from Le Moyne College.

David is a husband, father, and grandfather based in Charlotte, NC. Soli Deo Gloria.

I would like to heartily thank Jeremiah, the author of this book, for trusting me to review his work, and also my wife, Amy, for supporting me throughout my career to be in a position where my input matters.

Table of Contents

Preface

Part 1 – SASE Market Perspective

1

SASE Introduction

Define SASE

Market SASE

Value SASE

Embrace SASE

Present SASE

Summary

2

SASE Human

Human Issue

Human Problem

Human Behavior

Human Solution

Human Patterns

Summary

3

SASE Managed

SASE Self

SASE Co-managed

SASE Managed

SASE Operational

SASE Success

Summary

4

SASE Orchestration

SASE Manual

SASE Template

SASE Integrate

SASE Orchestrate

SASE Automate

Summary

5

SASE SD-WAN

SD-What

SD-Why

SD-How

SD-When

SD-SASE

Summary

Part 2 – SASE Technical Perspective

6

SASE Detail

Service Definition

Service Components

Service Roles

Service Requirements

Service Flight

Summary

7

SASE Session

SASE Session

SASE UNI

SASE Actors

SASE Flow

SASE Lifecycle

Summary

8

SASE Policy

SASE Policy

SASE Quality

SASE Dynamic

SASE Trust

SASE Effective

Summary

9

SASE Identity

Access Identity

Dimensional Identity

Context Identity

Situation Identity

Integrate Identity

Summary

10

SASE Security

Secure Overview

Secure Details

Secure Session

Secure Automation

Secure Summary

Summary

11

SASE Services

Services Overview

Services Core

Service Options

Services Expanse

Services Explain

Summary

12

SASE Management

Management Overview

Management Systems

Management Templates

Management Automation

Management Simplified

Summary

Part 3 – SASE Success Perspective

13

SASE Stakeholders

Stakeholders Overview

Stakeholders Business

Stakeholders Technical

Stakeholder Users

Stakeholder Success

Summary

14

SASE Case

Case Overview

Case Insight

Case Examples

Case Design

Case Value

Summary

15

SASE Design

Design Overview

Design Theory

Design Function

Design Support

Design Communication

Summary

16

SASE Trust

Zero Overview

Zero Framework

Zero Feed

Zero Trust

Zero Explained

Summary

Part 4 – SASE Bonus Perspective

17

SASE Learn

Learn Overview

Learn Model

Learn Perpetual

Learn Timing

Learn Explain

Summary

18

SASE DevOps

DevOps Overview

DevOps Fervor

DevOps Continuous

DevOps Act

DevOps Impact

Summary

19

SASE Forward

Forward Overview

Forward Present

Forward Future

Forward Measured

Forward Concept

Summary

20

SASE Bonus

SD-WAN Overview

SD-WAN Design

SD-WAN Failure

SD-WAN Experience

SD-WAN Practice

Summary

SASE Conclusion

Appendix SASE Terms

Index

Other Books You May Enjoy

Preface

The SASE concept was coined by Gartner after seeing a pattern emerge in cloud and SD-WAN projects where full security integration was needed. The market behavior lately has sparked something like a space race for all technology manufacturers and cloud service providers to offer a SASE solution. The current training available in the market is minimal and manufacturer-oriented, with new services being released every few weeks. Professional architects and engineers trying to implement SASE need to take a manufacturer-neutral approach..

This guide provides a foundation for understanding SASE, but it also has a lasting impact because it not only addresses the problems that existed at the time of publication, but also provides a continual learning approach to successfully lead in a market that evolves every few weeks. Technology teams need a tool that provides a model to keep up with new information as it becomes available and stay ahead of market hype.

With this book, you’ll learn about crucial models for SASE success in designing, building, deploying, and supporting operations to ensure the most positive User Experience (UX). In addition to SASE, you’ll gain insight into SD-WAN design, DevOps, zero trust, and next-generation technical education methods.

Who this book is for

This book has been written for technology and security leaders, specifically CTOs, CSOs, CISOs, and CIOs who are looking for an executive approach to SASE for their organization. This book will help anyone implementing SD-WAN, SASE, and SASE services for cloud, network, and security infrastructure. It has been written with a market-central, vendor-agnostic approach beyond Gartner’s ideas of SASE. SASE services are the path forward for secure communications for people, devices, applications, and systems to and from anywhere. This book is a challenge and call to action for anyone looking to improve their security, networking, and cloud success.

What this book covers

Chapter 1, SASE Introduction, introduces the term SASE, which was recently coined by Gartner and has been dominating IT projects to ensure cost savings and provide the needed security. The overall book provides a comprehensive foundational-level understanding of what SASE is, how to use SASE for success, how to learn through each evolution, where to find more information, and what the future of integrated secure access solutions looks like.

Chapter 2, SASE Human, discusses how understanding SASE requires a mix of skills not commonly found in one person. Due to the DevOps methodology’s acceleration of software releases, a rapid approach to learning just-in-time prior implementation within two to six weeks is required for success. Miss the mark on this requirement and your employer ends up in the news for having the latest security failure in the market. Using a managed service provider that has multiple teams in lockstep with the developers allows an organization to pivot on demand, transfer liability, and meet the urgent needs of the organization on demand.

Chapter 3, SASE Managed, discusses how SASE is a different approach that requires the experience level of even the best engineers to be reset to zero. Once at zero, it can take 6 weeks or 6 months to achieve basic proficiency with design, implementation, and troubleshooting skills. This retooling of the engineering team within a non-technology-focused enterprise offers little value to shareholders or customers. Outsourcing to the right managed services partner allows the technology to provide business value much more quickly and change at the speed of the market.

Chapter 4, SASE Orchestration, looks at automated service management across potentially multiple operator networks, including fulfillment, control, performance, assurance, usage, security, analytics, and policy capabilities, which are achieved programmatically through APIs that provide abstraction from the network technology used to deliver the service.

Chapter 5, SASE SD-WAN, discusses SD-WAN, which provides a virtual overlay network that enables application-aware, policy-driven, and orchestrated connectivity between SD-WAN user network interfaces and provides the logical construct of an layer three, virtual private, routed network for the subscriber that conveys IP packets between subscriber sites.

Chapter 6, SASE Detail, deep dives into what makes a service SASE.

Chapter 7, SASE Session, looks at SASE sessions, which are the core component of a SASE solution. Connecting the target actor to the subject actor, regardless of connection type, in a secure session is the heart of SASE.

Chapter 8, SASE Policy, looks at SASE policies, which are sets of rules applied to the SASE session that can be integrated into SASE connectivity quality mechanisms as well as other SASE service inputs. In the past, policy-based firewall or routing solutions have been prescriptive, requiring a comprehensive understanding of the five Ws prior to implementation. The policy was written in stone to guarantee specific results. With SASE, a dynamic environment that allows machine interaction on demand is required for the service to offer a relevant value proposition. This environment is precursive to AI and has to be designed in a manner that allows for AIOps.

Chapter 9, SASE Identity, discusses how a multidimensional approach is required to integrate IAM, context, situational components, time of day, location, and many other factors to deliver sub-millisecond active security that is continuously relevant.

Chapter 10, SASE Security, discusses how each software product developer uses security vertically. In SASE sessions, these vertical solutions must integrate to form the pervasive security that is required for the solution.

Chapter 11, SASE Services, looks at how there are many services that can be included in a SASE service. Every service is not mandatory for a solution to be considered SASE, but every SASE service should have the ability to be integrated into an overall comprehensive solution for a secure connective solution. Potential example services for inclusion are listed in this chapter and are expected to evolve as this market matures.

Chapter 12, SASE Management, looks at establishing, monitoring, and enforcing the configuration, policy, and performance of any given component of or the overall SASE solution.

Chapter 13, SASE Stakeholders, discusses how the foundation for SASE solutions requires identifying all stakeholders in the end solution. Each stakeholder contributes to the cross-functional matrix approach in the project planning phase to qualifying security requirements.

Chapter 14, SASE Case, provides examples for educational purposes, but they are by no means recipe cards for implementation strategies or architectural blueprints. The Use Case in turn provides a model that allows for templated approaches that are necessary for scaling the ultimate solution.

Chapter 15, SASE Design, discusses how designing for SASE involves concepts relating to DevOps, security, SD-WAN, and the cloud, and displaces legacy LAN/WAN design principles primarily due to the disaggregation of data plane and control plane activity.

Chapter 16, SASE Trust, discusses the Zero Trust Framework, which is a cybersecurity architecture where all actors are authenticated, authorized, and continuously validated before subjects are granted access, maintain access to, or perform operations on targets.

Chapter 17, SASE Learn, discusses how SASE is a moving target that does not stop evolving. How do you learn something that is perpetually becoming more complex daily? How do you get ahead of the requirements? Where can you independently research this subject? We will provide answers to these questions in this chapter.

Chapter 18, SASE DevOps, discusses the DevOps mindset, which is a rigorous systematic, fervent approach to continual improvement through secure development iteration. Through iteration, the production release of code improves in security, reliability, and user experience.

Chapter 19, SASE Forward, discusses how the future of SASE will be completely different from today. But like the history of x86 computer hardware, it is somewhat predictable, and therefore, a pattern emerges that allows us to stay diligent and ahead of the next change.

Chapter 20, SASE Bonus, discusses how designing SD-WAN solutions is much more complex than a routed WAN with an identical scale. Multiple circuits across routers may be integrated by configuring a dynamic routing protocol that uses all available routes. In contrast, each SD-WAN path must be considered independently, and policies should be designed to give the orchestrator as much autonomy as possible in selecting the ideal path for each packet or flow.

To get the most out of this book

Software-defined technologies such as SD-WAN, SASE, and SDN are significantly different from the past four decades of network engineering. If you can accept this truth prior to reading this book, you may get more out of its content. This book is for those that want to deliver successful projects faster, further, and more cost-effectively than the market standard.

Conventions used

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: SD-WAN stands for software-defined wide area network.

Tips or Important Notes

Appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, email us at [email protected] and mention the book title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Share Your Thoughts

Once you’ve read Diving into Secure Access Service Edge, we’d love to hear your thoughts! Please click here to go straight to the Amazon review page for this book and share your feedback.

Your review is important to us and the tech community and will help us make sure we’re delivering excellent quality content.

Download a free PDF copy of this book

Thanks for purchasing this book!

Do you like to read on the go but are unable to carry your print books everywhere?

Is your eBook purchase not compatible with the device of your choice?

Don’t worry, now with every Packt book you get a DRM-free PDF version of that book at no cost.

Read anywhere, any place, on any device. Search, copy, and paste code from your favorite technical books directly into your application.

The perks don’t stop there, you can get exclusive access to discounts, newsletters, and great free content in your inbox daily

Follow these simple steps to get the benefits:

Scan the QR code or visit the link below

https://packt.link/free-ebook/9781803242170

Submit your proof of purchase

That’s it! We’ll send your free PDF and other benefits to your email directly

Part 1 – SASE Market Perspective

Part 1 provides a basic understanding of SASE from the market perspective. This perspective is the required baseline prior to considering a SASE-related project. In this section, there are the following chapters:

Chapter 1, SASE Introduction

Chapter 2, SASE Human

Chapter 3, SASE Managed

Chapter 4, SASE Orchestration

Chapter