Perimeter Security and SASE for Enterprise Group
Implementation of perimeter security solution with WAF and SASE Netskope platform for web application protection and secure access to corporate resources.
Category
Network Security
Year
2024
Team size
4 people
Timeline
6 months
Challenge
The enterprise group with 50+ companies and 15,000 employees operated with fragmented traditional security perimeter. Massive SaaS adoption, remote work and multiple critical web applications exposed the organization to data exfiltration risks and web attacks without centralized visibility.
Solution
Deployment of unified SASE architecture with Netskope as central platform, complemented with WAF for critical web application protection. Implementation of Zero Trust Network Access (ZTNA) model to replace traditional VPN and CASB for cloud application control.
The Modern Security Challenge
Organizational Context
The enterprise group faced typical challenges of accelerated digital transformation:
Operational Complexity:
- 50+ companies with partially independent IT
- 15,000 geographically distributed employees
- 340+ SaaS applications in use
- 45 critical proprietary web applications
- 67% hybrid/remote work
Traditional Model Limitations:
- Saturated centralized VPN (latency > 200ms)
- Perimeter firewall without cloud visibility
- Legacy WAF with outdated rules
- No SaaS application control (shadow IT)
- Fragmented DLP by tool
SASE Architecture Implemented
Platform Components
┌─────────────────────────────────────────────────────────────┐
│ SASE Platform (Netskope) │
├─────────────────────────────────────────────────────────────┤
│ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ │
│ │ SWG │ │ CASB │ │ ZTNA │ │ DLP │ │
│ │ Secure │ │ Cloud │ │ Zero │ │ Data │ │
│ │ Web GW │ │ Access │ │ Trust │ │ Loss │ │
│ └──────────┘ └──────────┘ └──────────┘ └──────────┘ │
├─────────────────────────────────────────────────────────────┤
│ Unified Analysis │
│ Threat Intelligence │ Behavioral Analytics │ ML │
└─────────────────────────────────────────────────────────────┘Zero Trust Network Access (ZTNA)
VPN Replacement:
| Aspect | Traditional VPN | ZTNA Netskope |
|---|---|---|
| Model | Network-centric | Application-centric |
| Access | Full network | Authorized apps only |
| Authentication | Once | Continuous |
| Visibility | Limited | Complete |
| Scalability | Bottleneck | Cloud-native |
| Latency | > 200ms | < 50ms |
Project Results
Visibility Improvement
Before vs After:
- Cloud traffic visibility: 0% → 100%
- SaaS applications inventoried: 32 → 258
- DLP coverage: 15% → 98%
- Users with ZTNA protection: 0% → 100%
Risk Reduction
Security Metrics:
- High-risk shadow IT: -78%
- Exfiltration attempts: 12,000 blocked/month
- Web attacks blocked: 500,000/month
- Malware detected: 2,340 instances/month
User Experience
Operational Improvements:
- Access latency: 200ms → 50ms
- VPN tickets: -89%
- Onboarding time: 2 days → 2 hours
- User satisfaction: 3.2 → 4.6/5
This project transformed the organization’s security model, moving from a reactive perimeter approach to a proactive SASE architecture that protects data and users regardless of location, enabling secure hybrid work and controlled cloud adoption.
Results
- 100% visibility of cloud and web traffic
- 78% reduction in shadow IT incidents
- 12,000+ exfiltration attempts blocked/month
- Web threat response time: < 5 seconds
- Traditional VPN elimination (-89% support tickets)
Technologies
Project Information
Related projects
Cybersecurity for Public Sector Fiscal Risk Use Case
Security architecture design for fiscal risk use case at Digital Agency, protecting sensitive citizen data and ensuring ENS compliance.
NIST Implementation for International Organization
Design and implementation of NIST 800-53 framework for international organization with operations in multiple countries and complex compliance requirements.