White Paper | The Hybrid SASE Advantage

THE HYBRID SASE ADVANTAGE

Cloud computing revolutionized the way business operates. It made company resources available worldwide, it meant IT teams could easily scale on demand, and it reduced the amount of time spent maintaining legacy equipment. The cloud set the groundwork for the hybrid revolution, and it permanently changed the cybersecurity industry. Cloud-based VPNs with global availability cropped up everywhere for business and consumer use. Security workload processing and analysis moved off the local device and into the cloud where more robust engines could distribute intelligence worldwide and enhance security with machine learning. The cloud also dramatically improved network security thanks to the rise of Secure Access Service Edge (SASE). A sector that most analysts believe will see major growth and adoption in the coming years. Current predictions expect to see the SASE market growing to $25 billion by 2027.

The cloud is an amazing tool, but it isn’t perfect for every purpose. There are use cases where the cloud should be augmented or even substituted for different approaches. That’s why Check Point’s Harmony SASE is focused on a hybrid architecture. One that embraces the cloud when it makes sense and sets it aside when it doesn’t.

The Cloud-Only Security Paradigm

Cloud-only security products do all their major operations in the cloud. They typically have an agent running on the local device, whether it’s a laptop, desktop, or mobile device; however, the agent is little more than a gateway to cloud functionality. There are many advantages to taking a cloud-only approach, especially for your customers. It’s easily scalable meaning customers only have to click a button and they can go from supporting a few hundred employees to a few thousand. Cloud-only also means centralized management for a global workforce and their resource access, and the ability to propagate changes nearly instantaneously across the network. A common use case for cloud-only security is zero trust network access to cloud and on-prem resources. There is simply no getting around the cloud if you want a global ZTNA solution. Secure connectivity must be in the cloud since, the only other alternative is to own a handful of on-prem VPNs, which simply doesn’t cut it when you want global access. Plus, cloud-based zero trust access means you can create a network of high-performance PoPs that ensure company traffic gets from point A to cloud resource B in the shortest amount of time possible.

Another Use Case: Secure Internet Access

Another use case is secure Internet Access, which many people know by its more traditional name: the secure web gateway (SWG). This is a function where all traffic must pass through a cloud-based security monitor, which takes care of SSL inspection (decryption and re-encryption) to scan for threats, as well as preventing access to disallowed and malicious websites. Zero Trust Access and secure Internet Access are two of the core components of a SASE solution. And most solutions deliver both through the cloud. At Check Point we believe this is a strategic error. Not only for the companies providing those solutions, but also for the customers purchasing them.

Limitations of Cloud-Only Security

A properly designed Zero Trust Access solution is far superior when it exists in the cloud compared to an on-prem solution. With a cloud-based solution, you can build a network of high-performance points of presence that work together to funnel an organization’s traffic as directly as possible to its destination. When you rely on the cloud for secure Internet Access, however, you run into problems rather quickly. Unlike accessing resources in AWS, GCP, or Azure, the Internet doesn’t require a gateway to stand between it and the user device. Inserting a gateway adds unnecessary latency. For example, most major websites rely on content delivery networks (CDNs) where the latest copy of their content is cached (temporarily saved) at strategic places around the world to ensure fast delivery. Why would you want to have your traffic travel to a distant, remote location and back just to access content that may be sitting on a server on the other side of town? Latency translates into noticeable lag that can frustrate users and reduce productivity.

Privacy and Geolocation

There’s also the question of SSL inspection where HTTPS traffic must be decrypted, analyzed for threats, and then re-encrypted before passing it on to its destination. This is a highly sensitive operation with significant privacy implications for employees and the company. Carrying out this operation in an uncontrolled environment, like with a cloud solution, exposes the company to risk. In some cases, it may not even be legal if local regulations require certain data to remain within its borders.

On a day-to-day basis the cloud might be fine, but what happens when your cloud provider experiences a breach due to a configuration error, a zero day in underlying technologies, or any number of other potential threats? Suddenly, that secure cloud service is a trove of data just ripe for hackers to do more damage. Why expose your company to this risk? It’s better to keep SSL inspection local by default with a hybrid provider. The cloud can also distort your browser’s built-in geolocation, which is helpful for more than just ordering lunch.

Imagine, for example, you need to access a government service as part of your day-to-day operations. The service in question requires an originating IP inside your country, but your closest internet access gateway is not. Now you must disconnect from your security service just to access the site--not ideal considering the sensitive data you’re about to access.

Better geolocation also helps streamline operations by offering you applications in the correct language or for ordering office supplies using the correct location.

The Hybrid Approach with Harmony SASE

We’ve seen when the pure cloud approach makes sense, and when it doesn’t. So, what does a hybrid approach look like? One that embraces the cloud where necessary and sets it aside when it’s not. Check Point’s Harmony SASE uses the cloud for Private Access, our Zero Trust remote access solution. As discussed earlier, you can’t have secure access without a gateway enabling secure connections and enforcing zero trust access rules, so it makes sense in this instance to have a cloud-based solution.

Secure Internet Access, however, is not the same. Harmony SASE takes all the essentials including malware protection, SSL inspection, and web filtering and puts all that capability on the device. This helps protect privacy and ensure security without impacting performance. Plus, skipping the cloud when appropriate provides our customers with internet speeds that are, on average, 2x faster than the competition.

We compared our speeds to all the major SASE providers, and none of them could beat us on raw internet speeds or download speeds retrieving documents from Office 365. But, as this is a hybrid approach, even here we offer flexibility. Consider, for example, a situation where you want considerably greater web protection when an employee is connected to the corporate network compared to when they’re not. For those situations, we provide DNS-based filtering in the cloud as an additional option. This allows companies to define granular web filtering rules on the device, but then apply additional rules to all users when they’re connected to the corporate network. That’s the power and flexibility of a hybrid approach.

Hybrid and Beyond with Harmony SASE

Harmony SASE’s hybrid approach improves performance, augments privacy, and provides flexibility for IT teams to manage and secure their users. That’s already a great advantage, but there’s more than just that. Since Harmony SASE is a fully managed solution, we handle maintenance of the underlying servers. No more hours spent updating and testing boxes all around the world, and you get the ultimate advantage of a cloud-delivered solution: easy scalability. Harmony SASE is also part of the Harmony Workspace Suite—a set of security tools that make sure your entire workspace is secure. In addition to SASE protection, the Workspace Suite includes out-of-band SaaS monitoring and security, email security, endpoint and mobile protection, and Browser Security.