SSE: Security Service Edge

The move to the cloud forces a re-architecture of networking and security to support users access to internal applications in physical and cloud datacenters, and public cloud applications, anytime and anywhere.

As the volume of Internet and cloud-bound traffic increases, it doesn’t make sense to send all traffic through the datacenter firewalls. Direct secure internet access must be enabled at every location and down to every remote user to enforce full visibility and control in a way that doesn’t impact the user experience.

With the shift to a hybrid work model, enterprise IT security must also adapt. Work from anywhere requires a platform with the agility and scalability to ensure full security and policy enforcement across all edges (users, locations, applications, application, clouds), wherever they are located.

Legacy security appliances are incompatible with today’s enterprise requirements: they’re location-bound, require constant maintenance, and cannot scale with increased load. Supporting a hybrid workforce requires a flexible, and scalable security architecture that can secure the entire workforce at any location: in the office, at home, or on the road.

Point solutions increase the manual work IT needs to perform in patching and upgrading, and the potential for errors and oversights. As-a-service delivery model can eliminate the need to update security infrastructure and maintain security posture.

SSE establishes a global fabric that connects all edges into a common security platform. All traffic between any two edges is inspected, and corporate policies are enforced for threat prevention and data protection.

SSE implements zero trust access, ensuring users only have access to authorized applications via least privilege access. Application traffic is continuously monitored for anomalies, threats, attacks, and sensitive data loss.

SSE is a cloud-native solution, delivered through a global backbone of PoPs. Security Service Edge seamlessly inspects all traffic, scales vertically and horizontally with traffic growth and minimize latency with each PoP residing within 25 ms of every user and location.

SSE offloads IT of the burden of manually deploying mitigations for emerging threats. The expertise of the Security Service Edge provider’s SOC ensures that end-users are always protected, and the enterprise attack surface is minimized.

The SSE provider continuously enhances all cloud-delivered capabilities as part of a self-maintaining service. This reduces IT workload and shifts focus to business-critical activities, rather than having to focus on “keeping the lights on.”

Cato’s Single-Pass Cloud Engine (SPACE) is the foundation of Cato’s global, converged, cloud-native service that delivers multi-gig packet processing and real time policy enforcement. Current SPACE capabilities powering Cato SSE 360 include: SWG, ZTNA, CASB/DLP, RBI, FWaaS and Advanced Threat Prevention (IPS, Next Generation Anti-Malware.)

Cato’s global, geographically distributed, SLA-backed network of 75+ PoPs interconnects multiple, Tier 1 carriers. Each PoP runs the full set of SSE capabilities across multiple compute nodes and SPACEs to ensure minimal latency, deliver global routing optimization, and fully automated self-healing service.

Users connect via lightweight clients to Cato. They can optimally and securely access the internet, internal applications, on-premises and in cloud datacenters, and global public cloud apps. Clientless access through an application portal is available for 3rd parties.

Physical and cloud locations connect with an IPsec enabled third-party devices or Cato Socket SD-WAN edges. Customers can opt to use current firewalls or SD-WAN edges that reside on their networks and benefit from Cato’s deep security capabilities. The Cato Sockets provide last mile resiliency and QoS and overcome blackouts and brownouts with application-based dynamic path selection and packet loss mitigation.

Our comprehensive management application provides clear security and network analytics, with full, granular policy configuration. Managed services include site deployment, intelligent last-mile monitoring, network configuration, security policy change, and Managed XDR.