Security Service Edge Fundamentals
What SSE actually converges
Security Service Edge is the security half of SASE. It bundles Secure Web Gateway, CASB, ZTNA and Firewall-as-a-Service into one cloud-delivered enforcement point, with DLP, DNS security and decryption as supporting services. Prisma Access runs all of those functions on a single-pass parallel processing engine, so a flow is decoded once and inspected by App-ID, User-ID and Content-ID together rather than being handed between four separate appliances.
The three deployment types you must name
- Mobile users - GlobalProtect agents on laptops and phones connect to the nearest mobile user location.
- Remote networks - IPSec tunnels from branches into a compute location.
- Service connections - IPSec tunnels from data centers or hubs, used to reach private applications and to give headquarters internet egress through Prisma Access.
Each type lands in its own zone, and security policy is written across those zones. You do not administer the underlying infrastructure firewalls; you declare intent and Prisma Access builds it.
Identity is the control plane
User-ID, Cloud Identity Engine, SCIM group sync and HIP checks decide which rule matches. Without correct identity, ZTNA and CASB rules silently degrade into IP-based rules.
Worked example
A retailer has 40 branches, 3,000 travelling staff and two data centers hosting an order system. Branches need internet security plus access to the order system; staff need consistent policy anywhere; SaaS usage must be visible. Mapping: remote networks for the 40 branches, service connections to both data centers, mobile users with GlobalProtect, CASB for SaaS visibility, and one shared policy set across all three. The trap answer is "put a firewall in every branch" - it solves the branch and nothing else.
Traps
- Treating SSE and SASE as synonyms; SASE also includes the networking (SD-WAN) half.
- Assuming mobile-user traffic enters at the compute location serving the private apps.
- Believing you need hardware on-premises for ZTNA.