De-Witt Tromp, Solutions Engineer at Broadcom, delivered a presentation on the Introduction to Zero Trust & SASE at Public Sector Cybersecurity 2023 on the 3rd of October 2023. #PublicSec2023 #Conference #Cybersecurity #PublicSector

1. Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
Introduction to Zero Trust &
SASE
De-Witt Tromp
- the industry frameworks for securing users in cloud in a perimeter-
less world

2. 2 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|

3. 3 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
The Evolution
Migrating Your Business to the Cloud
Business Perimeter
DNS Perimeter
Private
Datacenter
Private
Datacenter
Private
Datacenter
Network Perimeter

4. 4 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
The Challenges of Delivering on the Promise
Securing the Digital Transformation
The user experience suffers
from complexity and
poor performance
IT suffers from reduced security
visibility & control, and
increased complexity
Organizations suffer from
increased technology costs and
impacted productivity

5. Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
The Duo

6. 6 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
SASE capabilities are delivered as a service based upon the identity of
the entity, real-time context, enterprise security/compliance policies
and continuous assessment of risk/trust throughout the sessions.
Identities of entities can be associated with people, groups of people
(branch offices), devices, applications, services, IoT systems or edge
computing locations.
How Does One Enable the Other?
Formal Definition of SASE
The Zero Trust model is the de-facto security model which should be
supported and implemented by the controls available in the SASE
architecture.

7. 7 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Zero Trust
SCOPE
Devices Network
Zero Trust
Policy
People Resources
Employees
Partners
Customers
Laptops
Desktops
Phones
Tablets
Servers
Public
Private
Managed
On-prem
SaaS
PaaS
IaaS
Control
Context
Intelligence + Automation

8. 8 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Zero Trust
Intelligence + Automation
SCOPE
Devices Network
Zero Trust
Policy
People Resources
Employees
Partners
Customers
Laptops
Desktops
Phones
Tablets
Servers
Public
Private
Managed
VERIFY
On-prem
SaaS
PaaS
IaaS
Role
Task
Type
Agent
Version
Joined
Managed
Secure
Corp
Geo
Familiar
Botnet
Attacking
Scope
Classification
Sensitivity
Regulation
Risk
Threat Intel
Compliance
Time
Anomalies
Block
StrongAuthentication
Audit
Control
Context

9. 9 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Zero Trust
Intelligence + Automation
Devices Network
Zero Trust
Policy
People Resources
EXAMPLE
FTE Domain-
joined
Off-CorpNet HR Application
No anomalies MFA sign-in
Control
Context
When an FTE on a domain-joined machine tries to access a resource with no risk, require MFA.

10. 10 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
The SASE Experience
Pushing Simple, Fast, Flexible, and Scalable Security to the Service Edge
“Reduce complexity now on the network security side by moving to ideally one
vendor for secure web gateway (SWG), cloud access security broker (CASB), DNS,
zero trust network access (ZTNA), and remote browser isolation capabilities.”

11. 11 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
The SASE Experience
Pushing Simple, Fast, Flexible, and Scalable Security to the Service Edge
Gartner Magic Quadrant for Enterprise Data Loss Prevention
Gartner Magic Quadrant for Secure Web Gateways
Gartner Magic Quadrant for Cloud Access Security Brokers
The only vendor with:
 Agentless ZTNA
 Isolation as an integrated
capability
 Best-in-class SSL
decryption
“Reduce complexity now on the network security side by moving to ideally one
vendor for secure web gateway (SWG), cloud access security broker (CASB), DNS,
zero trust network access (ZTNA), and remote browser isolation capabilities.”

12. 12 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Secure SSL
Decrypt
File Extraction
& Inspection
Authentication
Advanced Malware
Analysis Service (Sandbox)
Remote Browser Isolation
DLP Inspect & Enforce
Cloud Visibility
& Control (CASB)
Cloud Firewall Service
Headquarters
w/ Data Center
Regional
Offices
Roaming
Users
NGFW
Connection
Services
Advanced Security Services
SWG Proxy
Inspect Before Delivery
URL / Content / Application
Categorization
SEP
WSS Agent
ProxySG
Accelerated
Cloud Backbone
Telco POP
Backbone
Automate Policy &
Content Acceleration
Elastic Cloud
SVC Structure
Content Peering &
Connection Scaling
3rd Party
Monitoring
Bandwidth
Enforcement
Secure Access Cloud (ZTNA)
SEP/Agent
Explicit or
Proxy Fwd
SD-WAN Connect
IPSec or B/W
The Symantec SASE Framework
De-Risk Your Secure Access and Reduce Costs
Private Data
Center
Internet

13. 13 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Security Operations Center (SOC)
All events are available or exported
to SIEM and other SOC
tools/dashboards
Symantec SASE in Action
Providing Fast & Secure Access to Resources for Users with Managed Devices
As the user attempts to access the internet, hosted corporate application, or public cloud service from
any location, they are consistently redirected to the nearest Symantec SASE Cloud service point
 SASE Cloud authenticates and validates user
 Firewall rules and acceptable use policies are
applied
 SSL traffic is selectively decrypted based on
compliance and privacy policies
 Relevant security controls inspect traffic and
implement policy
Accessing the Internet
 SASE Cloud authenticates and validates user
authorization
 SASE Cloud connects the user to application
 SASE Cloud applies all relevant policies and
controls to traffic in real-time
Accessing corporate hosted
applications (IaaS & data
center)
 SASE Cloud authenticates and validates user
authorization
 SASE Cloud forwards authorized user to SaaS
application without backhauling traffic to
corporate network
 SASE Cloud applies all relevant policies and
controls to traffic in real-time
Accessing SaaS applications

14. 14 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Security Operations Center (SOC)
Symantec SASE in Action
Providing Fast & Secure Access to Resources for Users with Unmanaged Devices
Users attempting to access hosted corporate applications or public cloud services are consistently
redirected to the nearest Symantec SASE Cloud service point without the need for an endpoint agent
 Redirection to SASE Cloud happens via
corporate domain (DNS) or application portal
 SASE Cloud authenticates and validates user
authorization
 SASE Cloud connects the user to application
Accessing corporate hosted
applications (IaaS & data
center)
 User authenticating to SaaS app is redirected
to the corporate Identity Provider (IdP) via
authentication redirection (SAML)
 Corporate IdP authenticates user and redirects
them to SASE Cloud’s Web Isolation platform
 SASE Cloud spins up a remote browser
instance and serves the virtualized SaaS
application to the user
 SASE Cloud applies all relevant policies and
controls to traffic in real-time
Accessing SaaS applications
All events are available or exported
to SIEM and other SOC
tools/dashboards

15. 15 Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
|
Symantec: Your Ideal Partner for Fulfilling the Promise of SASE
Deliver the SASE user experience today:
 Low-latency cloud and internet access for managed and unmanaged users
 Full breadth of best-in-class network security capabilities
Achieve unmatched performance and
operational efficiency over time:
 The lowest latency access and unlimited
scalability through our GCP migration
 Agentless access and managed endpoint
agent consolidation
 Simplified operations thanks to federated
solution management “Reduce complexity now on the network security side by
moving to ideally ONE VENDOR for secure web gateway (SWG),
cloud access security broker (CASB), DNS, zero trust network
access (ZTNA), and remote browser isolation capabilities.”

16. Broadcom Proprietary and Confidential. Copyright © 2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.
Thank you