SOLUTION BRIEF

Skyhigh Security
Security Service Edge (SSE)
The SSE security service empowering cloud transformation

Our Security Service Edge (SSE) solution is the security fabric

between your workforce and their resources that enables fast
direct-to-internet access by eliminating the need to route traffic
through your data center for security. Data and threat protection
are performed at every control point in a single pass to reduce the
cost of security and simplify your management.

1
SOLUTION BRIEF

Is Your Digital Transformation as Fast • Opening access to corporate resources

and Secure as It Should Be? through unmanaged mobile devices means
that data is being accessed in new ways that
We are in the midst of digital transformation that
are missed by perimeter security.
is reaping tremendous benefits, but also
presenting several substantial challenges. • Traditional security tools are not able to cope
with the 630% spike in advanced cloud-based
• As the workforce adopts a “Work from
and web-based threats.1
Anywhere” model, traditional VPN and MPLS-
connected branch users are only able to
access their critical web and cloud resources
by routing back through their traditional
network infrastructure, which is increasingly
congested and slow.

Corporate Network
Network Security
Applications
Appliances

Private
VPN Tunnels
Cloud
MPLS Lines
Internet

Remote Users Branch Offices

Traffic Flow

Figure 1. Traditional network architecture

1. Source: Skyhigh Security: “Cloud Adoption and Risk Report:

Work from Home”

2 Skyhigh Security - Security Service Edge

 SOLUTION BRIEF

Accelerate Your SSE Adoption with Our Skyhigh Security’s cloud-native Hyperscale

SSE Integrated Security Service Edge Service Edge—which processes your traffic for
Solution unauthorized access, data risk, and threats from
Security Service Edge (SSE) — anywhere in the world—and then directly to the
defined by Gartner2— is a Skyhigh Security SSE solution is the SSE security
cloud, eliminating the need to route traffic
collection of integrated, cloud- fabric that delivers data and threat protection to
through your data center and back out.
centric security capabilities that any location, so you can enable fast and secure
facilitates safe access to direct-to-internet access for your distributed • By transforming to a cloud-delivered SSE that
websites, cloud, and workforce. converges connectivity and security,
applications. The SSE framework organizations are then able to reduce cost and
As digital transformation creates a shift for
converges all security services, complexity while increasing the speed and
organizations to “Work from Anywhere,” enabling
including Secure Web Gateway, agility of the workforce.
fast and secure access for your remote workers to
Cloud Access Security Broker, your internal apps and data is crucial. With access • An SSE architecture delivers complete
and Zero Trust Network Access, delivered from a secure service edge, you can visibility and control over data at every policy
into a single, cloud-native protect users and data in new ways; from full decision point, whether it be at the endpoint,
framework. This integrated visibility over remote worker traffic, to unmanaged through the web, or in the cloud.
approach supports the digital device control, and cloud-native activity • Threat protection controls that adapt to
business transformation and monitoring. changes in risk and context allow for
workforce mobility, while
Unlock direct internet access by seamlessly protection against even the most
minimizing the impact on
routing office locations and remote users through sophisticated cyberattacks and data loss.
security performance,
complexity, and cost.
Cloud Apps

Web & Shadow Apps Private & Cloud-Developed Apps

& Data
Centers

Mult
tion i-V Pervasive DLP Across
tec ec Endpoint, Cloud and Web
Figure 2. Security Service Edge User & Entity Behavior ro
Analytics (UEBA) Real-Time Collaboration
to
tP

Control
rD
rea

Intelligent Remote Browser

ata

Isolation (RBI) Adaptive Risk-Based

anced Th

Real-Time Emulation Enforcement

Protection

Sandbox (30,000+ Apps Guided

Policy Advisor)
1 B Sensor Global Threat
Intelligence SECURITY
Adv

SERVICE EDGE Data-Aware ZTNA

99.999% Uptime Data-Aware CNAPP
H g SDWAN Enabled Cloud
yp
e

Ultra Low Latency

ers Ed NG Firewall
85+ Global Pops
c ale S ervic e

Managed & Unmanaged Remote Site

Head Quarters

3 Skyhigh Security - Security Service Edge

SOLUTION BRIEF

Deliver SSE with Skyhigh Security SSE The capability to provide the fastest access to
cloud applications possible, often outperforming
SD-WAN can transform your network with
direct-to-cloud access.
greater simplicity, cost effectiveness, and user
productivity by simplifying and accelerating the A simplified architecture that empowers you to
connections between users and cloud resources. enable the access patterns of your workforce—
However, unless it is coupled with a ubiquitous anywhere, any application, and from any device.
cloud security platform, traffic must still be Operates at 99.999% uptime to keep your
forced back to your data center. But doing this workforce connected without disruption.
slows down productivity and doubles down on an
Converge SD-WAN and ZTNA with our cloud-
already outdated architectural model.
delivered service edge to simplify your
Skyhigh Security’s Hyperscale Service Edge is technology stack so you have less to manage.
the cloud-native security fabric between your Enjoy low latency and unlimited scalability with a
workforce, WAN infrastructure, cloud services, global cloud footprint and cloud-native
and the web. Additional capabilities of our service architecture. By bringing together Skyhigh
edge include: Security SSE in a seamlessly integrated SSE
Over 60 Points of Presence (PoPs) peered with solution, organizations can reduce complexity
content providers at global Internet Exchange and costs while delivering a blazing fast user
Points (IXPs). experience.

Figure 3. SSE direct-to-cloud

transformation Corporate Network
Network Security
Applications
Appliances
SD-WAN
Fabric Links
via Broadband
Internet

Private
Cloud
IPSec/GRE
Internet

Tunnels
SECURITY
SERVICE EDGE

Branch Offices

Internet
Traffic Flow

4 Skyhigh Security - Security Service Edge

SOLUTION BRIEF

Multi-Vector Data Protection: Data • Shared data protection policies are enforced
Awareness at Every Access Point at every control point, allowing you to easily
decide who can see your data and what they
Cloud transformation has meant that a large
can do with it.
portion of enterprise data now resides and is
being accessed outside of the network perimeter • Unified incident management between con-
and beyond the reach of traditional data security trol points with no increase in operational
controls. Collaboration from the cloud to third overhead.
parties, between cloud services, access by Skyhigh Security SSE draws incident event
unmanaged devices, and devices at home information from all control points into one
connected to peripherals have created new blind management console for a single view of your
spots that typically require multiple fragmented data protection environment. The unified data
data protection solutions. classification and management view delivers
Skyhigh Security multi-vector data protection consistent detection results and prevents the data
provides full-scope data protection for your loss prevention (DLP) security gaps that occur
workforce and eliminates data visibility gaps. when using multiple tools with disjointed policies
Each control point works as part of a whole and reporting. Our solution enables the correlation
solution. of data incidents across all vectors, enabling
administrators to identify signs of potentially
• Data classifications can be set once and
serious attacks.
applied across policies protecting the end-
point, network, web, and cloud.

Figure 4. Skyhigh Security Block upload of Enables transfer of sensitive files to internal recipient
sensitive docs
SSE multi-vector data b & Can’t share with unapproved 3rd parties
We San
protection use cases isk ps ctio
i u m R w Ap ned
d o Saa
Me Shad S

G CA
SW SB
Shado k Web &

Enable email of sensitive files

ps

Block or limit access to

w Ap

to internal recipient
risky sites and enforce
Email

Can’t share with unapproved

Ris

tenant restrictions
CASB
SWG

3rd parties
High

User
P
DL
CN

nt
AP

oi
dp
P

rk
wo
En

Network DLP
et
lN

CSPM and CWPP Prevent copy to cloud

ca
Iaa

Lo

In-tenant scans prevent personal apps, USB, print,

S

&

malware and data loss screen capture, etc.

es
vic
De

Corporate Data Center

Prevent file uploads and

emails to unauthorized
sites or parties

5 Skyhigh Security - Security Service Edge

SOLUTION BRIEF

Defense Against Cloud-Native Threats User and Entity Behavior Analytics (UEBA) finds
and Advanced Malware threats that traditional technologies miss by
monitoring cloud activity across all your cloud
As valuable resources have shifted to the cloud,
services and refining millions of events to identify
threat actors have followed. New methods of
anomalies and threats in your environment. These
attack are emerging that leverage the features of
anomalies are correlated to DLP incidents, cloud
cloud providers to fly under the radar while
configurations, and app vulnerabilities to create a
searching for and stealing information.
pre-built view of cloud-native attacks using the
Additionally, the advanced malware and
MITRE ATT&CK framework.
malicious code used in fileless attacks remain an
evolving threat. New protection methods are Any malware that attempts to land on your
needed to detect and block these threats without endpoints meets a rigorous, line-speed inspection
impacting end-user productivity. Skyhigh path that includes the industry’s most accurate
Security’s integrated SSE solution defends real-time emulation sandbox. In cases where
against cloud-native threats, advanced malware, attacks forego malware in favor of zero-day
and fileless attacks with an array of traditional exploits or fileless attacks that leverage operating
and state-of-the-art threat protection capabilities. system commands or website code, users
These defenses mitigate the risk of attack and automatically enter a Remote Browser Isolation
data loss as your enterprise transforms its session, allowing for full use of the web with zero
network and productivity tools into cloud-based possible infection.
services. Additionally, all events can be shared with third-
party SIEM solutions to empower security
operations teams.

Figure 5. Security Service Edge

threat protection including
Remote Browser Isolation Reputation

Global Threat Intelligence

Anti-Malware

Emulation
Sandbox
Safe Risky

Remote Browser
Isolation

Content DLP Scanning

Activity Controls
Filtering Tenant Restriction

6 Skyhigh Security - Security Service Edge

SOLUTION BRIEF

Skyhigh Security Private Access— Cloud Firewall—Secure All Non-Web

Industry’s First Sensitive Data-Aware Traffic for Remote Users and Sites
ZTNA The proliferation of remote sites and users has
It’s important for users to have access to internal- challenged security practitioners to secure the
facing, private apps that often contain sensitive non-web and non-cloud traffic. Backhauling
information. Virtual Private Networks (VPNs) have every connection to centralized datacenters for
traditionally been used for this, but they suffer security inspection leads to network latency and
from performance and scalability issues, and affects the user performance.
make it difficult to enforce tight security controls. Cloud Firewall extends next-generation firewall
While traditional Zero Trust Network Access (NGFW) capabilities to remote users through a
(ZTNA) solutions provide fast, direct access to
cloud-delivered service model, securing local
private assets while employing granular dynamic internet breakouts across all ports and protocols.
access policies that prevent oversharing or lateral The solution includes a sophisticated policy
movement, they lack stringent data protection engine offering contextual awareness and a next-
controls to secure the sensitive data hosted generation intrusion prevention system (IPS) with
within those assets. superior IPS efficacy, while offering end-to-end
Skyhigh Security Private Access secures access traffic visibility for troubleshooting and optimizing
to private applications from any location and the network issues.
device, and controls data collaboration with Skyhigh Security Private Access and Cloud
integrated data loss prevention (DLP). Our Private Firewall converge with our Security Service Edge
Access performs continuous risk assessment of solution, offering organizations an all-
the connecting devices by deriving enhanced encompassing, cloud-delivered solution for
posture information providing blazing fast, “least accelerating their business transformation.
privileged” access to private applications through
a cloud-native hyperscale service edge.

7 Skyhigh Security - Security Service Edge

SOLUTION BRIEF

About Skyhigh Security

When your sensitive data spans the web, cloud
applications, and infrastructure, it’s time to
rethink your approach to security. Imagine an
integrated Security Service Edge solution that
controls how data is used, shared, and created,
no matter the source. Skyhigh Security empowers
organizations to share data in the cloud with
anyone, anywhere, from any device without
worry. Discover Skyhigh Security, the industry-
leading, data-aware cloud security platform.

Learn More
For more information visit us at skyhighsecurity.com

6220 America Center Drive Skyhigh Security is a registered trademark of Musarubra US LLC. Other
San Jose, CA 95002 names and brands are the property of these companies or may be claimed
888.847.8766 as the property of others. Copyright © 2022. March 2022
skyhighsecurity.com