--- title: "SASE: the new security challenge" description: Secure Access Service Edge (SASE) is a cloud-based security model designed to support the dynamic, secure access needs of today’s hybrid organizations. image: https://newsroom.kireygroup.com/hubfs/Blog_security_sase_nuova_frontiera_sicurezza_informatica.jpg --- [kireygroup.com](https://www.kireygroup.com/) [![](https://newsroom.kireygroup.com/hubfs/item-2020-dicembre/logo-Blog-v2.svg)](https://newsroom.kireygroup.com/en/news) - [Ita](https://newsroom.kireygroup.com/news/sase-la-nuova-frontiera-in-ambito-security?hsLang=it) - Eng - [Esp](https://newsroom.kireygroup.com/es/news/sase-la-nueva-frontera-de-la-seguridad?hsLang=es) [Kireygroup.com](https://www.kireygroup.com/) # Get your daily dose of tech! ## We Shape Your Knowledge # [Welfare: from compliance to competitiveness, digital services and technologies are key to pension funds’ future](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) By Michela Sertorio, Business Line Manager - BU Pension Funds atKirey. [Read more](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) 9 MIN READ 26 October 2026 ### Latest News - [Welfare: from compliance to competitiveness, digital services and technologies are key to pension funds’ future](https://newsroom.kireygroup.com/en/news/welfare-digital-services-and-technologies-are-key-to-pension-funds-future?hsLang=en) - [Inference Costs: how to prevent AI agents from driving costs up exponentially](https://newsroom.kireygroup.com/en/news/inference-costs-how-to-prevent-ai-agents-from-driving-costs-up-exponentially?hsLang=en) - [Kirey Advisory at the ABI Lab workshop on Processes, Operations and Organization](https://newsroom.kireygroup.com/en/news/kirey-advisory-at-the-abi-lab-workshop-on-processes-operations-and-organization?hsLang=en) - [Kirey Strengthens Its SAP Presence: Mind The Value Achieves Reselling Partner Status](https://newsroom.kireygroup.com/en/news/kirey-strengthens-its-sap-presence-mind-the-value-achieves-reselling-partner-status?hsLang=en) - [The Dark Side of Multicloud: how to prevent workload placement from generating technical debt](https://newsroom.kireygroup.com/en/news/the-dark-side-of-multicloud-how-to-prevent-workload-placement-from-generating-technical-debt?hsLang=en) - [Shadow AI: 4 out of 5 employees use tools not governed by the company](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) 14 MIN READ 6 April 2021 - Share on: - - - - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) / # SASE: the new security challenge #### Kirey [![](https://newsroom.kireygroup.com/hubfs/it.svg)](https://newsroom.kireygroup.com/news/sase-la-nuova-frontiera-in-ambito-security?hsLang=it)    [![](https://newsroom.kireygroup.com/hubfs/ES.svg)](https://newsroom.kireygroup.com/es/news/sase-la-nueva-frontera-de-la-seguridad?hsLang=es) 14 MIN READ 6 April 2021 - Share on: - - - - [All](https://newsroom.kireygroup.com/news?hsLang=en) - Categories + - [Corporate](https://newsroom.kireygroup.com/en/news/tag/corporate) - [Cybersecurity](https://newsroom.kireygroup.com/en/news/tag/cybersecurity) - [Cloud](https://newsroom.kireygroup.com/en/news/tag/cloud) - [Data Value](https://newsroom.kireygroup.com/en/news/tag/data-value) - [Innovation](https://newsroom.kireygroup.com/en/news/tag/innovation) - [Artificial Intelligence](https://newsroom.kireygroup.com/en/news/tag/artificial-intelligence) - [Software Development](https://newsroom.kireygroup.com/en/news/tag/software-development) - [Corporate Social Responsibility](https://newsroom.kireygroup.com/en/news/tag/corporate-social-responsibility) - [Advisory](https://newsroom.kireygroup.com/en/news/tag/advisory) - [Welfare & Social Services](https://newsroom.kireygroup.com/en/news/tag/welfare-social-services) - [Press & PR](https://newsroom.kireygroup.com/en/news/tag/press) ## What is Secure Access Service Edge (SASE)? SASE is a cloud-based security model designed to support the dynamic, secure access needs of today’s hybrid organizations, that combines network, connectivity and security functions, offered as a service by the SASE provider. Conceptually, SASE integrates VPN and SD-WAN (*Software-Defined Wide Area Network*) capabilities with cloud native security features such as: secure Web gateways (SWG), cloud access security brokers (CASB), state-of-the-art Firewall (NGFW) and Zero Trust network access (ZTNA). The term SASE was first described by Gartner in a report on August 2019 called, “The Future of Network Security in the Cloud.” Gartner notes that in the SASE market trend report, "Customer demands for simplicity, scalability, flexibility, low latency, and pervasive security force convergence of the WAN edge and network security markets.” [![New call-to-action](https://no-cache.hubspot.com/cta/default/6224655/4113a355-76d3-404f-b71f-2e89c1b0c9fc.png)](https://cta-redirect.hubspot.com/cta/redirect/6224655/4113a355-76d3-404f-b71f-2e89c1b0c9fc) # **Why is SASE necessary?** The traditional function of the WAN network was to connect branches or remote locations to applications hosted in the data center, ensuring connectivity with dedicated MPLS circuits that ensure reliable connectivity and an adequate level of security. The increasing deployment of Cloud and Saas (Software-as-a-Service), Iaas (Infrastructure-as-a-Service) and Paas (Platform-as-a-Service) have inverted access requirements, with more users, devices, applications, services and data located outside an enterprise than inside. This makes the WAN network inadequate, expensive and unable to guarantee the levels of dynamism, speed, performance, security and access control required by modern applications. Therefore, the SASE approach represents the logical evolution of security needs and technological trends and addresses to these needs, by providing network and connectivity security controls at the edge, i.e., as close as possible to the users. ![SASE convergence\_senza scritte-1](https://newsroom.kireygroup.com/hs-fs/hubfs/SASE%20convergence_senza%20scritte-1.png?width=700&name=SASE%20convergence_senza%20scritte-1.png) Figure 1 – CDN: content delivery network; RBI: remote browser isolation; WAAPaaS: web application and API protection as a service. ### **Components** of SASE model The SASE model is based on access security, transforming the network model from "hub and spoke", where access to Internet applications and resources is Data Center-Centric, to "user centric", where access decisions are Identity-centric and applied to the endpoint. The user is identified at the time of connection and on this basis access policies are applied that are no longer bound/limited to the internal or external connection to the corporate network.   ![traditional data centric\_senza scritte-2](https://newsroom.kireygroup.com/hs-fs/hubfs/traditional%20data%20centric_senza%20scritte-2.png?width=700&name=traditional%20data%20centric_senza%20scritte-2.png) Figure 2 – NSP: network service provider   The main components of the SASE model are: Software Defined WAN (SD-WAN): a technological approach that decouples network hardware from its control mechanism. It implies the possibility of creating hybrid networks (on intelligent and dynamic platforms) that allow multiple access technologies, bandwith on demand, dynamic routing and security services, integrated with each other. Zero Trust Network Access (ZTNA): a network security model that verifies users' identities and establishes device trust before granting them access to authorised applications. It helps organisations prevent unauthorised access, contain breaches, and limit an attacker's lateral movement on your network. Firewall-as-a-Service (FWaaS): a Cloud platform that makes firewall service and security services available everywhere. Secure Web Gateway (SWG): Web access gateway which integrates advanced security features to protect your users/workstations using Internet resources. Organizations can secure and enable corporate resources while securing and delivering their sites, applications, and APIs. Cloud Access Security Broker (CASB): Application for the use of Saas applications. In-line implementation for real-time control of Saas User-Application interaction, or off-line implementation based on "API telemetry" available with Saas Providers. ### **![sase identity centric architecture\_senza scritte-1](https://newsroom.kireygroup.com/hs-fs/hubfs/sase%20identity%20centric%20architecture_senza%20scritte-1.png?width=700&name=sase%20identity%20centric%20architecture_senza%20scritte-1.png)** **Figura 3 – AWS: Amazon Web Services; DLP: Data Loss Prevention; GCP: Google Cloud Platform; O365: Office 365; SDP: service delivery platform; UEBA: user and entity behavior analytics** ### **Benefits of SASE** The SASE approach leads to the transformation of the network from the "hub and spoke" model to "user centric" model, in which access decisions are based on the identity of the user and are applied to the endpoint. The SASE provider becomes the new corporate **WAN backbone**, avoiding concentrating connectivity and security in the data center, avoiding both bottlenecks caused by limited bandwidth and additional latency; limitations typical of the "hub and spoke" model.   The [SASE security model](https://blog.paloaltonetworks.com/2019/11/cloud-next-generation-network-security/) can help your organization in several ways: ✔️ **Optimized connectivity** - Independence from transport mechanism and network equipment - Active-active hybrid connections for all network scenarios - Dynamic routing on all available connections - Uniform extension of the WAN to multi-cloud systems ✔️ **Cost saving** - Replace or combine the use of expensive MPLS routes with cheaper and more flexible Broadband (DSL, LTE, 4G, 5G, etc.) ✔️ **Better User Experience** - Application traffic with dynamic routing to ensure better performance for critical applications ✔️ **Maggiore sicurezza** - Centralized Policies based on the Zero Trust model and customization - Real-time access monitoring and control - Secure traffic in Internet and Cloud connections - Security deployment in remote endpoints ✔️ **Centralized and simplified application management** - Centralized monitoring and management dashboard - Zero-touch provisioning on all functional components ### **What are the new challenges in SASE Security?** In a context of growing adoption of cloud-based services, sharing information, data and files is becoming increasingly easy and frequent. Organisations should review threat vectors to adapt the desired safety posture: - **Identification and control of compromised accounts**: ability based on user behavioural analysis (UBA) capabilities to mitigate damage caused by misuse of the cloud by employees and compromised accounts. - **Anti-malware automation for cloud apps**: a feature that automatically scans and fixes malware infections in the user’s cloud application accounts. - **Advanced Threat Defense**: Provides an advanced level of threat protection (Advanced Threat Protection) to analyze files moving in and out of Cloud accounts. - **Mitigation of attacks through cloud-based email:** email uses the SMTP protocol, which is a different channel than most Internet access and requires specially designed threat prevention capabilities. The solution must protect against phishing attacks with Isolation (RBI) techniques and, when e-mails contain attachments or URL links, they must be scanned with anti-malware engines and analyzed in sandboxes. ### **SASE and Kirey Group** Kirey Group supports companies to ensure adequate protection of business information through the adoption of a unique, consistent and standardised approach. - Analysis of **AS-IS Security capabilities**; - update of the **grid segregation model**; - definition of **TO-BE Security capabilities**; - support in the definition and implementation of the **Information Security Management System** (**SGSI**) consisting of principles, rules, requirements, methodologies, controls and security measures with the aim of preserving the security of company information and assets; - **protection**, in terms of confidentiality, integrity, availability, verifiability; - **definition of appropriate criteria**, management methods and use in accordance with the rules of law and internal and external regulations; - **IT risk reduction** through appropriate accident prevention and mitigation measures, in line with the IT risk appetite defined at company level. ### **Our Value** - **Specific expertise** in **Network and Enpoint Security**, **Threat Management**, **Data Security**, **IT Governance Risk and Compliance**; - **Experience** in security projects; - **Unique proposal**. [![New call-to-action](https://no-cache.hubspot.com/cta/default/6224655/dbec2f42-a4e4-496a-9f2b-f94cd9400f6f.png)](https://cta-redirect.hubspot.com/cta/redirect/6224655/dbec2f42-a4e4-496a-9f2b-f94cd9400f6f) - [Previous post](https://newsroom.kireygroup.com/en/news/the-maturity-model-processes-and-applications-for-converting-data-governance-into-opportunities-and-exploitation?hsLang=en) - [Read all posts](https://newsroom.kireygroup.com/en/news?hsLang=en) - [Next post](https://newsroom.kireygroup.com/en/news/metadata-which-are-the-differences-between-business-glossary-data-catalog-and-data-dictionary?hsLang=en) ## Related posts: #### [Shadow AI: 4 out of 5 employees use tools not gove...](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) “While 80% of professionals use AI in their work, only 22% rely exclusively on tools provided by the... [Read more](https://newsroom.kireygroup.com/en/news/shadow-ai-4-out-of-5-employees-use-tools-not-governed-by-the-company?hsLang=en) 11 MIN READ 6 April 2021 #### [Autonomous SOC: reality, limitations, and prospect...](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) Artificial intelligence is certainly not new to the world of cybersecurity. For more than a decade, ... [Read more](https://newsroom.kireygroup.com/en/news/autonomous-soc-reality-limitations-and-prospects-for-ai-driven-security?hsLang=en) 11 MIN READ 6 April 2021 #### [Cybersecurity awareness must change form: human de...](https://newsroom.kireygroup.com/en/news/cybersecurity-awareness-must-change-form-human-decision-quality-at-the-center?hsLang=en) By Roberto Marzocca, Head of Cybersecurity di Kirey For a long time, the cybersecurity sector has ar... [Read more](https://newsroom.kireygroup.com/en/news/cybersecurity-awareness-must-change-form-human-decision-quality-at-the-center?hsLang=en) 6 MIN READ 6 April 2021 #### Explore - [Home](https://www.kireygroup.com/) - [Competencies](https://www.kireygroup.com/en/competencies) - [Industries](https://www.kireygroup.com/en/industries) - [About Us](https://www.kireygroup.com/en/about-us) - [Tech&Partners](https://www.kireygroup.com/en/tech-partners) - [Careers](https://www.kireygroup.com/en/careers) - [Contact](https://www.kireygroup.com/en/contact) - [Corporate Social Responsibility](https://www.kireygroup.com/en/corporate-social-responsibility) - [Advisory](https://www.kireyadvisory.com/en) #### Policy - [Quality](https://www.kireygroup.com/oven/media/PKG-COMP-AL14-Quality-Policy.pdf) - [Security](https://www.kireygroup.com/oven/media/PKG-CIS-LG02-Security-Policy.pdf) - [Gender Equality](https://www.kireygroup.com/oven/media/PKG-COMP-LG03-Politica-per-la-parita-di-Genere-v2.pdf) - [Service Management](https://www.kireygroup.com/oven/media/PKG-COMP-AL45-Politica-per-la-gestione-dei-servizi.pdf) - [Environment](https://www.kireygroup.com/oven/media/PKG-COMP-AL44-Politica-Ambientale-Kirey.pdf) - [Health, Safety & Wellbeing](https://www.kireygroup.com/oven/media/PKG-COMP-LG02-Policy-on-health-safety-and-well-being-in-the-work-environment.pdf) - [ESG](https://www.kireygroup.com/oven/media/Policy-ESG-ENG-v1.pdf) - [Info on Data Processing](https://www.kireygroup.com/en/information-on-data-processing) #### Certifications - [ISO 9001:2015](https://www.kireygroup.com/oven/media/KIREY-S-R-L-9001.pdf) - [ISO/IEC 27001:2022](https://www.kireygroup.com/oven/media/KIREY-S-R-L-27001.pdf) - [PDR 125](https://www.kireygroup.com/oven/media/PDR-125-2022.pdf) - [ISO/IEC 20000-1:2018](https://www.kireygroup.com/oven/media/ISOIEC-20000-12018-ENG.pdf) - [ISO 14001:2015](https://www.kireygroup.com/oven/media/ISO-14001-2015-ENG.pdf) - [ISO 45001:2018](https://www.kireygroup.com/oven/media/CERTIFICATO-ISO-45001-KIREY-ENG.pdf) - [ISO 22301:2019](https://www.kireygroup.com/oven/media/ISO-22301-2019-ENG.pdf) #### Info **Kirey Srl** [info@kireygroup.com](mailto:info@kireygroup.com) Viale Francesco Restelli, 5 20124 Milano [kirey@pec.it](mailto:kirey@pec.it) **PI/CF**: 06729880960 **REA**: MI 1910802 **Tel**: +39 02 78625200 Capitale sociale 1.089.620,00  [![Linkedin](https://newsroom.kireygroup.com/hs-fs/hubfs/Linkedin.png?width=20&name=Linkedin.png)](https://www.linkedin.com/company/kireygroup/)   - [Privacy Policy](https://www.kireygroup.com/oven/media/Kirey-Privacy-ENG-policy-art-13.pdf) - [Cookie Policy](https://www.kireygroup.com/oven/media/Kirey-Cookie-Policy-ENG-1.pdf) - [Terms and Conditions](https://www.kireygroup.com/oven/media/Kirey-Website-Terms-and-Conditions-1.pdf) [![KIREY LOGO](https://newsroom.kireygroup.com/hs-fs/hubfs/KIREY_LOGO_PAYOFF_RGB_POS.png?width=200&height=72&name=KIREY_LOGO_PAYOFF_RGB_POS.png)](https://www.kireygroup.com/) © Copyright 2026 by Kirey