Endpoint Empathy: Why SASE Suits Mobile

Mobile devices are slowly dethroning the desktop PC when it comes to where the most work-related tasks get done.

The freedom of movement that smartphones can offer an employee means they're able to enjoy a previously unknown amount of choice regarding where they can work from, and this choice alone means that more and more are discovering the advantages of remote work.

In the past, remote workers would need to use approved-only devices, and most likely a VPN to connect to the enterprise closed-network. Other basic tools may have made an appearance as well, such as SMS-based multi-factor authentication for verification via their mobile device.

These rudimentary tools are not enough for the modern work environment. A significant disadvantage to remote work and the still popular BYOD (Bring Your Own Device) culture is that the number of unsecured endpoints has grown exponentially, and are connecting to more cloud-based resources, which is a major security threat to any organization's network.

With limited visibility for IT security as well as other issues with high maintenance and misaligned configurations, it's now critical to have a robust infrastructure in place to reinforce security for a swarm of employee endpoints.

Introduction to SASE ( Secure Access Service Edge )

Because of the disparate nature of security products and how they’re consumed, it was only a matter of time before an evolutionary shift occurred in the way security vendors tackled the issue of securing mobile endpoints. Why? Securing more endpoints connected with a multitude of solutions simply wasn’t efficient and neglects rifts that expose the network to breaches.

SASE (Secure Access Service Edge; a Gartner-coined term) describes a new breed of unified cloud-based security as a service solution, and it may hold the key to the future of BYOD security gaps and securing mobile endpoints.

One of the most significant security flaws when using unmanaged mobile devices is they lack the processing power and security features required to prevent the creation of vulnerable entry points. It's not unheard of for mobile phones to be shipped with pre-installed malware in the OS, or for unknowing users to download malicious apps capable of infecting or controlling the device, and also any network it connects to. Which leads us to the question, how can SASE secure these vulnerable endpoints?

Putting Security on the Edge

One of the most commonly used methods to secure endpoints is to apply security measures at the edge of your network where endpoints connect. This means that resources and the utilities that protect them are hosted in a geographical location proximate to whatever user is accessing them. But the more edges a network has, the greater the attack surface becomes.

Ideally, edge security measures will include intrusion detection and prevention, access control, automatic monitoring, encryption, and other fundamental protocols and tools.

But the crucial problem facing organizations is how to ensure all endpoint devices are adequately secured to prevent hackers from gaining access through loopholes and lax defenses.

Placing security on the edge of the network with connected devices, as opposed to just at the perimeter, allows organizations to create more role-and-device-focused access policies rather than a singular rule that reads: “If you have the right credentials, you get unlimited network access.” Focusing on users and how they move through the network, not just how they get in, is a modern approach that boosts security especially for cloud-based resources and remote workers.

Combining SASE and SD-WAN

SD-WAN is essentially software-defined WAN architecture that allows organizations to centralize and control traffic across their WAN with one admin panel.

SASE is built on SD-WAN, meaning you’re able to integrate your network security and network access management into one unified platform. It allows organizations to efficiently manage network security while providing user-based and least-privileged access dependent on granular identifiers like user role, device, and location.

A SASE solution also allows organizations to combine cloud-integrated features like 2FA, which requires users to verify their identity against two knowledge factors, and Zero Trust Security Access. This is key for endpoint security especially, as users must double-authenticate with the devices themselves.

Commonly referred to as Zero Trust, users are given access to only the resources they absolutely need and are monitored at all times to reduce surface attack areas, and they must be verified each time they connect. It's an aptly-named method that's proven to help reduce the number of successful attacks and also, non-forced errors that occur within the network.

Factors Which Are Critical to Secure Mobile Endpoints

Planning and strategy

The organization needs to properly plan and execute a strategy that takes into account current IT infrastructure and introduces new endpoints without compromising network security.

Training and compliance

The majority of an organization's employees aren't aware of the security risks involved in downloading apps, connecting with non-secure devices to a company network, or accessing data through unsecured public Wi-Fi. Educating employees on best practices will enhance your overall security and reduce risk with BYOD devices and mobile endpoints. Especially as employees become aware of the greater impact of their personal security hygiene, network threats dry up as people work to improve themselves.

Create a mobile policy

Create a physical or digital mobile policy document which provides guidelines, such as banning jailbroken devices, and how to implement password and access control on devices properly. Awareness about phishing attacks as social hacking is still a significant problem and should be addressed as well.

By far, the biggest barrier to security an organization can run into is a lack of empathy for endpoints vulnerabilities, ignoring the possible threat they represent. Thankfully, it’s not insurmountable, and the right mix of tools and security business flows make fast work of establishing a robust security posture.

Final Word

By itself, implementing SASE won't be enough to protect an organization from harmful attacks, but it can be the essential backbone to be proactive about securing various endpoints and “locking the door” to hackers in as many ways as possible. This makes it expensive for them to attack you, and it’s known that hackers often go for the lowest-hanging fruit only