SASE vs. Zero Trust: What's the Difference

Secure access service edge (SASE) has some overlap with zero trust, but it's also a broader term. Analyst firm Gartner introduced the acronym (pronounced "sassy") in 2019. Like zero trust, SASE architecture requires some bold collaboration from security and networking teams to bring together software-defined wide area networking (SD-WAN) and multiple security technologies, including:

• Secure web gateway (SWG) to prevent unsecured internet traffic from entering the network
• Zero trust network access (ZTNA) to give users secure, least-privileged access to internal applications
• Cloud access security broker (CASB) to ensure secure, compliant use of cloud apps and services
• Firewall as a service (FWaaS) to deliver advanced threat prevention and access controls

Interest in SASE has evolved. After an initial explosion, progress slowed as organizations realized the extent of change required to fully implement it. The pandemic added further drag because there was simply no need to redesign site connectivity for empty sites. So, organizations prioritized the security changes, without the networking (SSE).

Now that the return to work is well underway, attention is returning to SASE, and especially to vendors who can offer the whole solution, eliminating the need to cobble together security and networking solutions from different suppliers.

At Zscaler, we take a different approach to SASE that removes the ineffective VPNs used by SD-WAN, preferred by traditional networking vendors for their SASE offerings. In place of VPN, Zscaler uses private encrypted tunnels to securely connect locations via the zero trust exchange. We call it Zero Trust SD-WAN, an alternative approach that removes the risk of lateral threat movement inherent in traditional SD-WAN designs.

SASE overlaps with, but is distinct from zero trust

Implementing a true SASE solution will partially deliver zero trust, but only for private applications. Zscaler offers the same zero trust approach for private applications as well as those accessed on the web (SaaS), internet access, and other application types. The zero trust principle "never trust, always verify" applies to all device, workload, user, and third-party traffic. Identity, user, and device context plus business policies are all considered before a connection is made to an application.

Learn more in this ESG research paper.