As SaaS applications dominate the business landscape, organizations need optimized network speed and robust security measures. Many of them have been turning to SASE, a product category that offers cloud-based network protection while enhancing network infrastructure performance.
However, a new report: “Better Together: SASE and Enterprise Browser Extension for the SaaS-First Enterprise” (Download here), challenges SASE’s ability to deliver comprehensive security against web-borne cyber threats on its own. From phishing attacks to malicious extensions and account takeovers, traditional network traffic analysis and security falls short. The report sheds light on these limitations and introduces the role of secure browser extensions as an essential component in a comprehensive security strategy.
SASE Advantages and Limitations
SASE takes on a dual role in addressing both infrastructure and security. However, while SASE offers clear advantages in security, it may not entirely cover the expanse of the web-borne threat landscape. SWG, CASB, and NGFW are not a silver bullet to all the security needs of the SaaS-first organization, even when they are packaged as SASE.
The modern threat landscape is shaped by the centrality of the browser as a main working space. These new threats leverage the browser as a bridge between the device and organizational resources and aim to gain malicious access to the organization through phishing, malicious extensions, and account takeover, to name a few. While SASE is designed to protect the perimeter from threats that attempt to enter it, this new threat landscape relies on traffic from the browser to a SaaS app or website, which SASE does not entirely cover.
Bridging the Gap with Secure Browser Extensions
Secure browser extensions complement SASE’s network security measures. Through deep session analysis and proactive threat prevention, these extensions provide granular visibility and real-time protection against sophisticated web-borne threats, effectively addressing the gaps left by SASE.
SASE vs. Secure Browser Extensions: 3 Use Cases
How do the differences between SASE and secure browser extensions play out when it comes to actual threats? The report provides three use cases.
1. Phishing
- SASE limitations: SASE’s NGFW or SWG lacks visibility into the actual session, leaving it to rely on known malicious addresses or emulate the session in a virtual environment. As a result, SASE misses ~60% of malicious web pages. It also is unable to detect pages that disable their phishing activity when executed in a virtual environment.
- The solution: A secure browser extension provides granular visibility into the live session, enabling the tracking of malicious components in the phishing web page and disabling them in real time.
2. Malicious Extensions
- SASE limitations: SASE’s NGFW or SWG lacks the ability to detect and block outbound traffic generated by any malicious extensions.
- The solution: The secure browser extension provides visibility into the browser and detects and disables all extensions that introduce a data exfiltration risk.
3. Account Takeover
- SASE limitations: SASE’s CASB lacks visibility into complex, modern web apps and depends on the app’s API, limiting protection to sanctioned apps.
- The solution: The secure browser extension integrates with the organizational identity provider and acts as an additional authentication factor. Access is possible only from a browser that has the extension.
With SaaS app usage becoming dominant, the more important the role of the browser becomes – and the threat landscape it encounters will increase. Can organizations ignore the risks that derive from the modern browser? According to LayerX, network security is insufficient on its own, and they call for complementary measures that can address SASE’s gaps.
To read more about how to gain real-time protection against this evolving risk with a secure browser extension, read the entire report.
https://thehackernews.com/2024/03/sase-solutions-fall-short-without.html
