{"id":108401,"date":"2020-03-27T12:00:19","date_gmt":"2020-03-27T19:00:19","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=108401"},"modified":"2021-09-12T22:56:50","modified_gmt":"2021-09-13T05:56:50","slug":"cloud-connectivity","status":"publish","type":"post","link":"https:\/\/www2.paloaltonetworks.com\/blog\/2020\/03\/cloud-connectivity\/","title":{"rendered":"Secure Connectivity Is the Only Connectivity"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">The mobile workforce has been growing over the years, but recent events, like COVID-19, have led to a sudden increase in remote workers, with many companies not prepared or able to quickly adopt technologies to securely enable the transition.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">For companies seeking to <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2020\/03\/cloud-securing-remote-workforces\/\"><span style=\"font-weight: 400;\">securely connect and scale remote workforces<\/span><\/a><span style=\"font-weight: 400;\"> \u2013 either temporarily or for the long haul \u2013 one option to consider is a cloud-based service. A <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/cyberpedia\/what-is-sase\"><span style=\"font-weight: 400;\">Secure Access Service Edge<\/span><\/a><span style=\"font-weight: 400;\"> (SASE) provides a fundamental solution for this need, as it combines networking services and security services delivered from a single cloud platform.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h4><b>Remote Working Evolves<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Years ago, working with technology and protecting users was relatively simple. Users commuted into an office where they used stationary desktop computers to access company resources via local area networks. As time went on, users were able to gain some mobility with laptops and occasionally connected to corporate resources with <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/cyberpedia\/what-is-a-vpn\"><span style=\"font-weight: 400;\">virtual private networks (VPNs)<\/span><\/a><span style=\"font-weight: 400;\">.\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Even before its recent rise, remote work was becoming more popular.<\/span> <span style=\"font-weight: 400;\">The <\/span><a href=\"https:\/\/www.owllabs.com\/state-of-remote-work\/2019\" rel=\"nofollow,noopener\" ><i><span style=\"font-weight: 400;\">2019 State of Remote Work Report<\/span><\/i><\/a><span style=\"font-weight: 400;\"> revealed that 42% of remote workers plan to work remotely more frequently than they currently do in the next 5 years, and that more than half of on-site workers want to start working remotely. Not only are users becoming more mobile, they are using multiple devices, such as laptops, tablets and smartphones, in order to be productive. Additionally, applications have been moving out of the data center to the cloud, adding to the complexity.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h4><b>SASE: Providing Connectivity with Security<\/b><\/h4>\n<p><span style=\"font-weight: 400;\">Traditional VPN technologies can still be used to apply some level of security and access but are not ideal for the rapidly changing environment and increasing performance expectations of users. The need for direct to internet connectivity from anywhere on any device, securely, has led to the adoption of technologies like Software Defined Perimeter (SDP) and <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/cyberpedia\/zero-trust-and-sase\"><span style=\"font-weight: 400;\">Zero Trust Network Access<\/span><\/a><span style=\"font-weight: 400;\"> (ZTNA). ZTNA is a fundamental component of a <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2020\/01\/cloud-zero-trust-network-access\/\"><span style=\"font-weight: 400;\">SASE solution<\/span><\/a><span style=\"font-weight: 400;\"> to implement the \u201cnever trust, always verify\u201d philosophy and authenticate access to the cloud, restrict access and minimize data loss. ZTNA provides users access to organizational resources located in public or private clouds while the company has complete inspection and security over the data being accessed. However, ZTNA products based on an SDP can lack content inspection capabilities needed for consistent protection.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Some vendors blur the lines between the two technologies, but you should ask a few questions before adopting a solution, especially if rapidly deploying to previously unmanaged or unknown devices:<\/span><\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li style=\"font-weight: 400;\"><b>Does the solution allow for specific controls on what applications and protocols a user\/group can access?<\/b><span style=\"font-weight: 400;\"> Traditional VPN brings users fully onto the network with no control of their lateral movement. Segmented application access is essential for security purposes.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Can my users access SaaS, Private Cloud and Public Cloud applications securely from a point of presence (POP) relatively close to their physical location?<\/b><span style=\"font-weight: 400;\"> Modern users have high standards for user experience and bandwidth. As applications move out of the data center, applying security close to the user is essential to enable user productivity.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Is it possible to inspect my traffic to ensure that malware prevention and data loss prevention (DLP) policies are applied? <\/b><span style=\"font-weight: 400;\">Remote access creates an additional threat vector to organizational resources. If traffic is not inspected to apply <\/span><a href=\"https:\/\/www.paloaltonetworks.com\/enterprise-data-loss-prevention\"><span style=\"font-weight: 400;\">DLP <\/span><\/a><span style=\"font-weight: 400;\">and antimalware policies, the attack surface is significantly increased.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Does the solution have functionality for unmanaged device access?<\/b><span style=\"font-weight: 400;\"> Users may require the ability to work using unmanaged devices, especially in critical situations. Allowing secure access to resources from unmanaged devices can reduce or eliminate shadow IT while enabling user productivity.<\/span><\/li>\n<li style=\"font-weight: 400;\"><b>Can my vendor handle peak bandwidth without disruption or outage? <span style=\"font-weight: 400;\">As we have seen with COVID-19 response, some vendors are unable to handle significant increases in usage as organizations onboard remote users. It is critical that your vendor can dynamically scale to handle these situations and prevent service disruption.<\/span><\/b><\/li>\n<li style=\"font-weight: 400;\"><strong>Does the solution provide the ability to connect to endpoints for troubleshooting or management needs?<\/strong> <span style=\"font-weight: 400;\">Being able to connect to endpoints is extremely valuable for troubleshooting, management and support purposes to help you provide support for your users when they need you the most.<\/span><\/li>\n<li style=\"font-weight: 400;\"><strong>How difficult is it to implement and transition from my hardware VPN solution?<\/strong> <span style=\"font-weight: 400;\">Real world factors need to be considered when selecting a vendor. Ease of deployment, ease of management and time to value are key areas for any organization to evaluate. Ideally, SASE solutions should be manageable using as few administrative interfaces as possible and be quick to deploy based on existing policies.<\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h4><strong>A True ZTNA Approach to Secure Connectivity<\/strong><\/h4>\n<p><span style=\"font-weight: 400;\">By considering these questions, you can ensure you are adopting a true ZTNA approach that will enable you, when ready, to onboard a SASE vendor. <\/span><a href=\"http:\/\/start.paloaltonetworks.com\/10-tenets-SASE\"><span style=\"font-weight: 400;\">SASE <\/span><\/a><span style=\"font-weight: 400;\">is critical in enabling your users to work remotely with limited bandwidth disruptions and provides security while accessing the Internet, SaaS applications, cloud applications and private data center resources. As practitioners, we must enable our users to be productive while ensuring we take all the necessary security precautions. If a \u201cZero Trust\u201d vendor isn\u2019t inspecting traffic, are they really providing secure access?<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Learn more about <\/span><a href=\"https:\/\/start.paloaltonetworks.com\/replace-remote-access-vpn.html\"><span style=\"font-weight: 400;\">securing remote users without compromising connectivity<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">This blog is part of a series explaining the modern realities of cloud security. Read the previous entry, \u201c<\/span><\/i><a href=\"https:\/\/www.paloaltonetworks.com\/blog\/2020\/03\/cloud-proxy-based-firewalls\/\"><i><span style=\"font-weight: 400;\">Why Proxy-Based Firewalls Are Not Enough<\/span><\/i><\/a><i><span style=\"font-weight: 400;\">.\u201d\u00a0<\/span><\/i><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The need for direct to internet connectivity from anywhere on any device, securely, calls for new approaches, such as the Secure Access Service Edge.<\/p>\n","protected":false},"author":663,"featured_media":108402,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6768,6765],"tags":[1011,6881,7006],"coauthors":[6846],"class_list":["post-108401","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-secure-the-cloud","category-secure-the-enterprise","tag-proxy","tag-sase","tag-secure-access-service-edge","sase_category-use-cases"],"jetpack_featured_media_url":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-content\/uploads\/2020\/03\/NGFW-Firewalls.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/108401","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/users\/663"}],"replies":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/comments?post=108401"}],"version-history":[{"count":16,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/108401\/revisions"}],"predecessor-version":[{"id":108950,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/posts\/108401\/revisions\/108950"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media\/108402"}],"wp:attachment":[{"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/media?parent=108401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/categories?post=108401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/tags?post=108401"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www2.paloaltonetworks.com\/blog\/wp-json\/wp\/v2\/coauthors?post=108401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}