Explicador de arquitetura single-pass SSE / SASE

O que atuou

Pilares

SWG

Transversais

DLP, Threat protection

O passe, em ordem

1. ● Steeringrede

   Traffic reaches the service edge by client.

   The endpoint agent steers selected traffic to the nearest point of presence. It is the only method that carries device posture and user identity with the flow.

2. ● Point of presencerede

   The request arrives at an edge location running the complete inspection stack.

   The architectural claim worth checking in any SSE product is whether every location runs full compute, or whether some are thin nodes that only resolve DNS and forward. A thin node means a detour to somewhere that can actually inspect.

3. ● TLS decryptioncondicional

   The session is decrypted once.

   Decryption happens ONCE for the whole pass. In a chain of separate appliances each device decrypts and re-encrypts, and that repetition is most of the latency people blame on inspection.

4. ● Application identificationtransversal

   Protocol, host and path are examined to identify the application, and often the specific instance and the activity.

   This is the step that distinguishes a corporate tenant of a service from a personal one. Without it, policy can only speak about domains, and 'allow the company account but not the personal account' is not expressible.

5. ● Secure web gatewaypilar

   URL category, risk and web policy are evaluated.

   The destination is web traffic, which is what a secure web gateway governs.

6. ○ Cloud access security brokerpilar

   Application, instance and activity are matched against policy - upload, download, share, post.

   Not engaged: no software-as-a-service application is involved.

7. ○ Zero trust network accesspilar

   The user is brokered to one private application, and to nothing else.

   Not engaged: no private application is involved.

8. ○ Cloud firewallpilar

   Ports and protocols outside web traffic are evaluated.

   Not engaged: this is web or application traffic.

9. ● Data loss preventiontransversal

   Content is classified against the data profile.

   DLP is NOT a pillar. It runs inside the same pass and receives whatever the pillars decrypted, which is why one data profile covers web, software-as-a-service and private applications alike.

10. ● Threat protectiontransversal

    Files and content are scanned, with sandboxing where the verdict is uncertain.

    Also cross-cutting, and running in the same pass on the same decrypted stream rather than after a re-encryption.

11. ● Adaptive decisioncondicional

    The verdict can be more than allow or block: coach the user, isolate the session in a remote browser, require step-up authentication, or permit a read-only view.

    Device posture is known, so policy can be more permissive with justification rather than simply refusing.

Contra appliances encadeados

• Chained appliances decrypt and re-encrypt at every hop. A single pass decrypts once and hands the same stream to every engine.
• Chained appliances each hold their own policy. A single engine holds one policy, so 'block this data leaving' does not need writing four times in four dialects.
• Chained appliances add their latencies together, and each one is a place the chain can break. A single pass adds its engines in parallel within one traversal.

Vale saber

• Single-pass is an architectural claim, not a bundling claim. Several products are sold as converged and are four engines behind one invoice - the question to ask is whether the payload is decrypted once or once per engine.