Akamai today added secure web gateways to its security platform as it moves toward a secure access service edge (SASE) architecture for delivering security at the edge.

Gartner coined the term SASE, and it’s a type of architecture that consolidates networking and security capabilities into an edge cloud-delivered service.

In an interview with SDxCentral, Akamai CTO of Security and Strategy Patrick Sullivan said his company already provided several SASE components via its Intelligent Edge Platform. This included enterprise-grade zero-trust network access, distributed domain application security, threat protection at the domain name service (DNS) traffic level, and a cloud proxy to provide additional security for some traffic at the URL level and inspect risky payloads for malicious behavior.

Adding secure web gateways means that customers can now send all of their web traffic to Akamai’s Enterprise Threat Protector for deeper inspection. All of this traffic will be compared against Akamai’s real-time DNS and URL threat intelligence, which can block a huge amount of malicious traffic before an IP connection is made. Additionally, the inline payload analysis engines now provide offline scanning for larger files, and a cloud sandbox can provide further analysis.

“One of the big trends we see is SASE,” Sullivan said. He acknowledges that Akamai doesn’t provide the full SASE networking and security stack but adds “if you look at the checklist for SASE, no one does 100 percent of the things in there.”

However, Akamai’s 20-plus-years edge experience — the company claims its quarter of a million edge servers, deployed in thousands of locations and residing within one network hop of over 90% of the world’s Internet users — gives it a, well, edge over the competition, Sullivan said. “Edge is a proper noun in our mind, and it’s an important component of how we do the zero-trust access. We’ve done threat protection at the DNS level, this is moving us into the web stack. We’ve had a selective proxy for a couple years and that works well for some locations, but we know that there are other organizations that want an always-on proxy,” and the new secure web gateway provides this capability.

Delivering security at the edge, close to users, plays a vital role in Akamai’s security strategy because it means that customers don’t have to choose between performance and security, Sullivan said. “If you are at the edge, which is the right place to make security decisions, you can integrate more of these [security] tools, and it makes things operationally more efficient to our customers,” he added. As Akamai looks to add security and networking capabilities to its platform, “we are going to add items our customers ask for, and the SASE list seems to line up pretty well.”

Also this week Akamai updated its distributed denial of service (DDoS) scrubbing service. This is a carrier-agnostic, fully managed service, and the update extends the DDoS mitigation capabilities to a number of sectors including critical infrastructure, financial services, and gaming platforms. It also added support for Amazon Web Services (AWS) and Equinix colocation facilities.

Sullivan says these combined security updates echo customer’s concerns about zero-trust access and DDoS protection. And while he says these two security challenges were already top of mind for customers before the pandemic, the global spread of COVID-19 — and the related influx of remote workers — “have moved proven, resilient, remote access to the top of everyone’s priority list.”

“Adversaries look for weak points, and that is where they launch attacks,” Sullivan said. As more employees work from home and connect to the company’s network, these remote workers and devices become the weak point. “People see a big shift where they had X percentage working remote, and now they have 10x,” he said. “They are concerned that’s a weak point, and if an attacker wanted to target a DDoS attack against remote access infrastructure, that’s where they are more susceptible.”

This is where secure web gateways and DDoS protection comes into play. Plus, with the sheer number of employees working from home, zero-trust access networks using secure web gateways becomes more scalable and cost-effective than virtual private networks (VPNs) and VPN licensing.

“It certainly is an accelerant of the trend that was already happening,” Sullivan said. “Trying to remove trust from the network, and moving security controls to the edge, [the COVID-19 pandemic] isn’t causing people to think of a brand-new area. But instead of the three-year plan it might be a three-week plan.”