Does Secure Access Service Edge (SASE) Meet OT Security Needs?

What is SASE?

Secure Access Service Edge (SASE) is a cloud architecture model that combines network and Security-as-a-Service functions together and delivers them as a unified, cloud-native service. The purpose of SASE is to allow organizations to more simply and efficiently support dispersed remote and hybrid users, while also ensuring security and visibility. SASE solutions have rapidly grown in popularity as organizations have adopted digitalization, work-from-anywhere, and cloud computing.

Key SASE Components

• Software-Defined Wide Area Network (SD-WAN)

• Secure Web Gateway (SWG)

• Cloud Access Security Broker (CASB)

• Firewall-as-a-Service (FWaaS)

• Zero Trust Network Access (ZTNA)

Major SASE Falls Short in Operational Technology (OT) Environments

1. SASE Solutions Derive Their Value from the Cloud

SASE solutions are designed for the world of information technology (IT). The very premise of SASE architecture is that all traffic travels over the internet through the cloud, and the vendor does the rest: decryption and inspection, policy enforcement, and traffic routing. Simply put, all value-add and security occurs in the cloud.

This cloud dependence is rarely a problem in IT scenarios; however, it is a key reason why SASE is not a viable secure access solution for the on-premises, isolated, and legacy-based systems that typically characterize operational technology (OT) environments. And even for cloud-connected OT systems, SASE deployment may require upgrades or infrastructure changes that cannot be easily supported.

How Cyolo Helps: Cyolo PRO (Privileged Remote Operations) is purpose-built for the distinctive needs of OT and industrial control systems (ICS). The solution can be deployed in any environment (cloud-connected, on-premises, or fully offline) and is designed to accommodate OT priorities like safety and systems availability. Cyolo PRO can even retrofit legacy systems to support multi-factor authentication (MFA) with no costly upgrades or rip-and-replace.

2. SASE Solutions Lack Privileged Access Controls

Due to their elevated access permissions, privileged users are more likely to intentionally or unintentionally cause severe damage to the organization. This is particularly true in an OT context, when a cyberattack can lead not just to financial loss but also to extended downtime and even threats to human safety. SASE solutions generally do not include the specialized controls necessary to monitor and manage privileged access scenarios.

How Cyolo Helps: Cyolo PRO provides an extensive range of crucial connectivity and supervisory controls designed to ensure secure access for privileged users. These include supervised access, just-in-time (JIT) access, control over what specific actions may or may not be performed during a session, and the ability to terminate a connection in real time if suspicious behavior is detected.

3. SASE Solutions Do Not Secure Third-Party Vendor Access

Most SASE tools require an agent to be downloaded onto the user’s device. Third-party vendors frequently use their own devices, and forcing them to install an agent is not practical. Third-party users may also experience sluggishness or poor performance when using a SASE solution. Beyond causing frustration, this can lead to higher costs as latency results in more billable hours.

How Cyolo Helps: In contrast to SASE, Cyolo PRO is designed to provide simple and secure access for the third-party vendors and technicians who help keep operations running. The solution is agentless, enabling third parties to easily connect with no downloads needed. In addition, Cyolo PRO ensures fast connections regardless of network conditions or geographic location, optimizing performance and responsiveness for badged employees and third-party vendors alike.

The Bottom Line on SASE

SASE solutions can provide great benefits when it comes to connecting remote and hybrid users to cloud-based IT technologies; however, they are of limited use for securing access to on-premise or isolated OT systems. Unlike SASE, Cyolo PRO is designed to satisfy the unique needs of OT and ICS. Cyolo PRO enables organizations in critical industries to safely and securely connect privileged users, including remote workers and third-party vendors, to even the most sensitive systems and environments.