SASE Solutions and Network Security for Multi-Site Organizations

What SASE is, in plain terms

Secure access service edge (SASE) combines networking and security in one cloud service. Instead of sending every user back through a firewall at headquarters, each user and each site connects to a nearby cloud security point, where the same policy is applied every time: who the user is, what device they are on, and whether they should reach that app.

The result is consistent protection for people in offices, at home and on the road, private app access without a traditional VPN, and one policy across every site instead of a different rule set on each firewall.

Who needs SASE

SASE pays off fastest when the network has outgrown a single building. It is usually the right conversation if your organization has:

• Several sites: clinics, branches, plants, warehouses or offices that each have their own firewall and their own rules.
• Hybrid and remote staff: people who work from home or the road and still need internal apps.
• Cloud-first apps: Microsoft 365 and other SaaS tools that no longer live behind the office firewall.
• Regulated data: patient, financial or client records that auditors and insurers expect you to protect and document.

BTI works most often with multi-site organizations of roughly 40 to 300 users, plus larger distributed organizations, in healthcare (medical groups, behavioral health, pharmacies and dental), manufacturing, logistics, financial services and professional services.

The building blocks of SASE

Platforms package these pieces differently. Which components each path covers natively, and which need an add-on, is mapped for your environment in the written design.

For SD-WAN planning by industry, see our Meraki MX SD-WAN guides for healthcare SD-WAN, financial services SD-WAN and logistics and manufacturing SD-WAN.

BTI SASE solutions: two paths

BTI offers two SASE paths and recommends the one that fits the stack you already own.

Both paths: BTI designs, deploys, manages and documents. We help you choose in the consultation; there is no one-size answer. BTI is a Cisco Select Partner, and the Cisco path is built on Cisco Meraki: Meraki MX SD-WAN & Security, Meraki & Catalyst Switches and Meraki Wi-Fi. The Microsoft path ties access to the identity controls on Identity, MFA & Devices.

Where firewalls and segmentation fit

SASE secures users and app access wherever they are. Sites still need local protection for local traffic, segmentation and SD-WAN, so BTI manages both layers together:

• Managed firewalls: next-generation firewalls with intrusion prevention, content filtering, and default-deny rules, reviewed on a schedule. Remote desktop and other remote access ports are not exposed to the internet.
• Segmentation: guests, staff, servers, payment systems, cameras and building systems on separate networks, so a compromised device has a much harder time reaching other systems.
• Secure remote access: zero trust network access through SASE, or VPN with MFA where a VPN still makes sense.
• DNS and web filtering: block known malicious and unwanted destinations. For your public website and domains, see website and DNS security.
• Wi-Fi security: enterprise authentication and separate guest access.
• Monitoring: network devices monitored by the 24/7 NOC/SOC, with logs available to the managed SIEM.
• Documentation: network diagrams, rule reviews and change records as evidence.

SASE covers the network path. The devices at each end need their own layer: endpoint protection, patch and vulnerability management and managed detection and response (MDR).

Planning new sites or a refresh? See network design and network installation, or work with our local teams for network design in Los Angeles, Chicago network design and Phoenix and Tucson network design.

How we move you to SASE

1. Discovery and assessment: current firewalls, rules, segments, remote access, Wi-Fi, identity platform and the apps people use.
2. Path and design: a written design and itemized proposal, including the SASE path that fits and what happens to existing firewalls and VPNs.
3. Pilot: a small group of users and one site first, so policies are proven before wider rollout.
4. Staged cutovers: site by site and group by group, scheduled to minimize disruption, retiring legacy VPN access as users move.
5. Ongoing management: monitoring, policy and rule reviews, firmware updates and reporting.

BTI can run SASE end to end as part of managed IT services, or alongside your internal team through co-managed IT support.

SASE and network security for converged environments

Cyber and physical threats overlap, and your defenses should too. Cameras, access control and building systems belong on segmented networks with managed firmware and MFA on remote portals, and remote access to those systems should follow the same zero trust policy as everything else. See Converged Cyber + Physical Security and IoT & OT Security.

Compliance and cyber insurance alignment

Unmanaged remote access, flat networks and gaps in firewall rules are among the controls auditors and insurers look at first. SASE and segmentation give you consistent access policy plus the records to show it: network diagrams, policy and rule reviews, and change records. That documentation supports healthcare privacy rules, PCI DSS segmentation and financial safeguards programs, and the questions on cyber insurance applications. BTI provides the controls and the evidence; your auditor or insurer makes the final determination. See Cyber Insurance Readiness and IT compliance. For the written program around these controls, see WISP, incident response plans and GRC and vCISO and cybersecurity consulting.

SASE in Los Angeles, Chicagoland and Phoenix

BTI has been in business for over 40 years and supports organizations from its Southern California, Chicagoland and Phoenix offices, plus multi-site organizations across the United States. Local cybersecurity: Los Angeles, Chicago, Phoenix & Tucson. Local SD-WAN and WAN services: Los Angeles SD-WAN services, Chicago SD-WAN services, Phoenix SD-WAN services. Local Cisco Meraki teams: Los Angeles Meraki partner, Chicagoland Meraki partner, Phoenix Meraki partner. Explore all cybersecurity services.