Secure Service Edge · Topic 1 of 5
Security Service Edge and Secure Access Service Edge
Learn what Security Service Edge and SASE are, which security services SSE bundles, how SASE adds SD-WAN, and where Cisco Secure Access fits in the design.
- 5 min
- Includes a diagram
- SSE is the cloud delivered security part of SASE.
- SASE is SSE plus SD-WAN.
- Core SSE services are SWG, CASB, ZTNA and FWaaS, with DNS security, DLP and isolation often included.
What it is
Security Service Edge (SSE) delivers security services from the cloud, close to the user, and SASE adds networking to that.
Staff now work from homes, branches and cafes, and applications live in many clouds. Backhauling all traffic to a central data centre firewall is slow and costly. SSE moves the security checks into cloud points of presence, so any user gets the same policy wherever they are.
How it works
SSE is the security half of SASE, and SASE is SSE plus wide area networking.
The idea of SSE
The term SSE was introduced by Gartner to describe the security part of SASE. It brings together several services in one cloud platform, with one policy engine. Traffic is inspected once, and decisions use the identity of the user and the state of the device, not only the network address.
Core SSE services
| Service | What it does |
|---|---|
| Secure web gateway (SWG) | Proxies web traffic, and filters URLs, malware and risky content |
| DNS layer security | Blocks requests to malicious domains before a connection starts |
| Cloud access security broker (CASB) | Controls the use of SaaS applications and protects the data in them |
| Zero trust network access (ZTNA) | Gives access to a single private application, not the whole network |
| Firewall as a service (FWaaS) | Provides cloud delivered Layer 3 and Layer 4 filtering, and often more |
| Data loss prevention (DLP) | Detects and blocks the leaving of sensitive data |
| Remote browser isolation | Runs risky web pages away from the user device |
The services share one policy and one management console. That is the main advantage over a collection of separate products.
What SASE adds
SASE combines SSE with software defined wide area networking (SD-WAN). SD-WAN connects branches and data centres across ordinary internet and private links, and picks the best path for each application. Together they give a single design for connecting and securing every site and user.
| Term | Scope |
|---|---|
| SSE | Cloud delivered security services only |
| SASE | SSE plus SD-WAN and networking |
You can adopt SSE alone and add SD-WAN later, or use an existing SD-WAN with a separate SSE service.
Where Cisco fits
Cisco Secure Access is the Cisco SSE product. It combines SWG, DNS layer security, CASB, ZTNA, FWaaS, DLP and related functions in one service. Cisco SD-WAN used together with Cisco Secure Access is the Cisco approach to SASE.
Cisco Secure Access has two main areas that match later topics. Secure Internet Access protects traffic from users to the internet and SaaS. Secure Private Access gives users access to private applications.
How traffic reaches the cloud edge
Traffic must be steered to the service. There are several methods, and a design often uses more than one.
- Client software: Cisco Secure Client on a laptop sends traffic to the service.
- Network tunnels: a branch router or firewall builds an IPsec tunnel to the service.
- Proxy settings: a browser uses a PAC file or explicit proxy setting to send web traffic.
- Connectors: a small component inside a private network makes an outbound connection to the service.
Benefits and trade-offs
The benefits are consistent policy, no backhaul, elastic capacity and less hardware to manage. The trade-offs are dependence on the provider and on internet access, and the need to steer traffic correctly.
An SSE design also supports zero trust. Access depends on who the user is, what device they use and what they are asking for, and is no longer granted because of network location.
What to remember for the exam
Six facts cover most questions on this topic.
- SSE is the cloud delivered security part of SASE.
- SASE is SSE plus SD-WAN.
- Core SSE services are SWG, CASB, ZTNA and FWaaS, with DNS security, DLP and isolation often included.
- ZTNA gives access to one application, and not to the whole network.
- Cisco Secure Access is the Cisco SSE product, and with SD-WAN it supports a Cisco SASE design.
- Traffic reaches the service by client, tunnel, proxy settings or connector.
If a question mentions SD-WAN together with cloud security, the answer is SASE. If it mentions only security services, the answer is SSE.
Common mistakes
These four mistakes appear often.
Treating SSE and SASE as the same thing. SASE includes the networking part, and SSE does not.
Treating ZTNA as the same as a classic VPN. ZTNA gives per application access, while a classic VPN gives network level access.
Forgetting traffic steering. The service can only protect traffic that reaches it.
Assuming SSE removes the need for endpoint security. Endpoint controls still protect the device.
Cloud delivered security does not secure traffic that bypasses the service. Check that no direct path to the internet exists for unprotected users.
Check yourself
Work through these three questions.
How does SASE differ from SSE?
SASE combines the SSE security services with SD-WAN networking, while SSE covers only the cloud delivered security services.
Which four services are core to SSE?
Secure web gateway, CASB, ZTNA and firewall as a service, with DNS layer security and DLP often included.
What is Cisco Secure Access?
It is the Cisco SSE product, which combines services such as SWG, DNS security, CASB, ZTNA and FWaaS in one cloud service.
Topic 1 of 5 in Secure Service Edge
Test yourself on Secure Service Edge
The full Cisco CCNP 350-701 SCOR question bank has 822 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.