Networking
Network Segmentation and NAC: Containing Threats Inside the Network
A flat network lets one compromised device reach everything. Segmentation and network access control limit the blast radius of any incident.
Key takeaways
- SD-WAN optimises traffic across multiple links.
- SASE combines SD-WAN with cloud-delivered security services (SSE).
- Remote and cloud-first workforces benefit most from SASE.
- Migrate in phases, starting with remote access or internet security.
Definitions
- SD-WAN — software-defined wide area networking that steers traffic intelligently across MPLS, broadband and mobile links.
- SSE (Security Service Edge) — cloud-delivered secure web gateway, cloud access security broker, ZTNA and firewall-as-a-service.
- SASE — the convergence of SD-WAN and SSE into a unified, cloud-delivered architecture.
Comparison
| Aspect | SD-WAN | SASE |
|---|---|---|
| Focus | Connectivity and performance | Connectivity plus security |
| Users covered | Branch sites | Branches, remote users and cloud |
| Security | On-box firewall | Cloud-delivered inspection and ZTNA |
| Management | Network team | Network and security together |
When to choose which
SD-WAN alone may suffice for site-centric organizations with strong on-premises security. SASE fits organizations with many remote users, heavy SaaS use and the goal of consistent policy everywhere.
Migration path
- Replace VPN with ZTNA for remote users.
- Move internet security to a cloud secure web gateway.
- Deploy SD-WAN at branches with direct internet breakout.
- Converge policy management.
Considerations
Check provider points of presence near your users and where logs are stored to meet performance and privacy requirements.
Evaluating SASE providers
| Criterion | What to check |
|---|---|
| Points of presence | Proximity to your users and offices |
| Security services | SWG, CASB, ZTNA, FWaaS, DLP coverage |
| Performance | Latency, throughput and SLA commitments |
| Management | Single policy engine and console |
| Integration | Identity provider, EDR and SIEM |
| Data handling | Log storage location and retention |
Business case
SASE business cases usually combine circuit savings from replacing MPLS with broadband, reduced hardware at branches, retirement of VPN concentrators and on-premises proxies, and improved user experience for SaaS. Include the cost of change and parallel running.
Operating model
SASE blurs the line between networking and security teams. Agree who owns policy, who handles changes and how incidents are triaged before deployment.
How NAZZTEC helps
We assess network and security architectures, compare SD-WAN and SASE options neutrally, design phased migrations and operate the resulting platforms through our managed services. As a Fortinet partner we bring certified engineers, while remaining open to the best fit.
Next step: see Networking & Connectivity Solutions — NAZZTEC partners with Fortinet.
Frequently asked questions
Is SASE a single product?
It can be single-vendor or multi-vendor. Single-vendor simplifies management; multi-vendor can offer best-of-breed components.
Does SASE replace firewalls?
It replaces many branch firewall functions; data centres often still need firewalls.
How long does migration take?
Phased programmes typically run six to eighteen months depending on site count.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
