Secure Access Service Edge:What is SASE?

SASE delivers security capabilities to the edge based on the nation-wide edge nodes of Alibaba Cloud, leased lines, and the zero trust security model. For enterprises that run multiple branches or stores and enterprises whose employees need to work remotely or from different locations, SASE provides zero trust-based remote access, audit of behavior in internal networks, data loss prevention, and network access control.

After an enterprise deploys SASE, the administrators of the enterprise need to only configure related features and policies in the SASE console. Then, SASE delivers the configured policies to the SASE client. After the employees of the enterprise install the SASE client on their devices and enable protection-related features, the enterprise can use SASE to control access of the employees.

Private access

The private access feature supports Software as a Service (SaaS)-based zero trust access by adopting the software-defined perimeter (SDP) approach. The feature allows you to manage access permissions of employees without the need to expose public IP addresses or reconstruct your existing network architecture. The feature is suitable for the following scenarios:

• Network access control in office zones

  The feature supports 802.1x-based network access control by using certificates. You do not need to enter usernames or passwords or import certificates. You need to only install the SASE client to ensure secure access. The SASE client not only provides higher security and convenience in office network access, but also supports dumb terminals and whitelist terminals with account-password authentication. This allows devices such as printers and Internet of Things (IoT) devices to access your office network, facilitating network access control.

• Zero trust network access

  The feature uses an Alibaba Cloud-developed, HTTPS-based communications protocol and implements dynamic identity authentication. This way, access control based on the principle of least privilege becomes available from devices to devices over TCP and from devices to applications over HTTP and HTTPS. Compared with the traditional VPN access methods, the private access feature supports quicker access, more efficient O&M, more convenient deployment, and higher system security.

• Global office

  The feature is suitable for scenarios in which employees outside the Chinese mainland need to access services in and outside the Chinese mainland.

Internet access

The Internet access feature uses an efficient file analysis engine in the cloud, which does not consume the computing resources of terminals. The feature can audit and store sensitive data that is transferred outbound from terminals and generate alerts for the outbound transfers. The outbound transfer methods include portable storage devices, instant messaging (IM) tools, emails, transfer over HTTP, transfer over FTP, printing, burning, and cloud storage services. The feature can identify more than 100 types of files and is built in with more than 60 sensitive information dictionaries, facilitating office data protection.

• Monitor outbound file transfers to ensure data security

  The feature adopts the cloud data loss prevention (DLP) strategy to provide a lightweight solution for office data detection within enterprises. This allows the enterprises to monitor outbound transfer of sensitive data in real time and control data leak risks.

• Manage peripherals to ensure data security

  The feature allows enterprises to manage the data access permissions of the peripherals used by their employees and helps the enterprises identify outbound transfer of sensitive files.

• Manage watermarks to ensure data security

  The feature allows enterprises to enable screen watermarking and print watermarking for their employees. This helps the enterprises prevent significant business loss and protect office data.

Log analysis

• Use the log audit feature

  The log audit feature helps you audit network traffic in real time and provides the basis for you to handle unusual traffic.

• Use the log analysis feature

  The log analysis feature allows you to collect web access logs and protection logs from SASE and store the logs. Then, you can query and analyze the logs, view charts, and configure alerts in Alibaba Cloud Simple Log Service. This allows you to focus only on log analysis without the need to perform trivial log query and aggregation tasks.