What are the key differences between SASE and SSE?

SASE or SSE? In today's cloud-based and hybrid work environment, many IT managers are confronted with an important question: Which approach is better for their organization? SASE, or Secure Access Service Edge, combines both network and security services, while SSE, or Security Service Edge, focuses exclusively on security. What are the key differences between these two models? And which security solution is best suited for your company?

As companies increasingly rely on cloud services and employees access data and applications from anywhere, classic perimeter protection can no longer reliably secure hybrid networks. This is where SASE and SSE come in – two approaches that are redefining security and connectivity. Both concepts originated from the analyst firm Gartner, sharing similarities and key differences.

SASE: Revolution instead of evolution for network and security 

First, let's look at SASE: The term is a little older than SSE and was first used by Gartner in 2019 in the report “The Future of Network Security is in the Cloud”. Since then, SASE has been hailed as a fundamental realignment of corporate security.

Previous security concepts primarily emphasized the importance of protecting the perimeter, or the boundary of the corporate network, as the key line of defense. However, this approach no longer reflects reality. The era when companies managed all critical applications and services within their own data centers has passed. Many employees now access the network remotely using Virtual Private Networks (VPNs). As a result, traditional firewalls on the perimeter cannot provide comprehensive security for these modern infrastructures.

Benefits and drawbacks of SASE

With SASE, Gartner proposed a completely new security concept. SASE combines all network and security functions in a cloud-based platform, giving users secure access to all the applications, services, and data they need – regardless of their location.

However, SASE also has its drawbacks. For instance, it can pose challenges for companies, as Secure Access Service Edge is a model rather than a specific product that can be chosen based on their needs. Some providers are compromising the core SASE concept by adding unnecessary features, leading to avoidable expenditures of time, resources and at a high costs to their customers.

The significant changes that come with adopting SASE can lead to issues if there is resistance within the company. Gartner advises that the implementation of a SASE platform should be accompanied by a cultural shift within the organization.

SSE: The focus is on security

No wonder: SASE's mission is very comprehensive. It covers everything from wide area networks in the form of modern SD-WANs (Software-Defined Wide Area Networks) and central management to cloud-based security services. These include Secure Web Gateways (SWGs), Firewall as a Service (FWaaS), Zero Trust Network Access (ZTNA) and Cloud Access Security Broker (CASB). For many companies, SASE is simply too much and is very challenging to implement effectively.

Two years after the introduction of SASE, Gartner reiterated its position and presented another security concept with SSE. SSE makes it easier for companies to get started with overhauling their security strategy, as it contains only part of the components that make up SASE as a whole.

With SSE, Gartner has completely focused on security and removed everything related to the network aspects of the concept. This makes SSE suitable for companies that can initially do without an SD-WAN with features such as bandwidth management or application prioritization. However, this does not mean that these components would not be able to be added if there is a need for them later.

Step by step to SASE with SSE

Gartner has designed SSE in such a way that the path to SASE remains possible at any time. The relationship between SASE and SSE can be simplified with the following formula:

SSE + SD-WAN = SASE or SASE = SD-WAN + SSE

This is a simplified overview, but it effectively illustrates the transition from a pure SSE solution to a comprehensive SASE implementation. It's important to note that SD-WAN is just one of several network components involved in this process. The formula clearly outlines the step-by-step journey a company can take in achieving a full SASE solution.

While SSE deals exclusively with security services and is particularly suitable for companies that want to improve their security while maintaining the existing infrastructure, SASE also includes the network area.

Once the SSE components have been successfully deployed, an SD-WAN can be introduced next. However, this step entails more profound changes to the network. The benefits pay off as an SD-WAN improves network performance, scalability, and flexibility.

The right choice depends on the individual company.

Implementing SSE first, which may later lead to a full SASE implementation has several advantages for companies. First, it covers the most urgent aspect of security. 

Since SSE comprises fewer components than SASE, they can usually also be implemented more easily, faster, and with less effort in terms of personnel and resources. Further, costs are reduced as no additional network components are required. The existing infrastructure can be used. 

Nevertheless, the effort for SSE implementation should not be underestimated. Integrating new systems into existing infrastructure is always a challenge. It is crucial to ensure that your IT security solution aligns with your overall strategy. NCP's Next Gen VPN products fit seamlessly into the infrastructure as part of an IT security concept. In a SASE structure, they offer an SSE solution through software-based security components.

Both SASE and SSE are promising concepts in IT security. The coronavirus pandemic a few years ago further accelerated its introduction, as many companies sent their employees to work from home and further expanded their distributed infrastructure. 

If you want to delve deeper into the topic, we have summarized the most important advantages of SASE for you at a glance. In other articles, we have already addressed the reasons for getting started with SASE and have presented the network functions and the security aspects of the concept in detail.

Learn more about NCP’s Secure Enterprise VPN solutions