Lucas Noah 
The Future of Secure Web Access: Next-Gen Secure Web Gateways for a Connected World
A secure web gateway (SWG) ensures employees’ internet access complies with company policies. However, as the world shifts to remote working and cloud applications, SWGs are now required to cover an entirely new landscape. They must go beyond URL filtering and decode apps’ API traffic for content and context. This is why next-gen SWGs are necessary.
Next-Gen SWGs need to be Scalable
SWGs started as hardware appliances that served as web proxies, terminating user requests and connecting them to web servers. They scanned the content of webpages for security threats and compared them against blocklists. Later, they evolved to add advanced threat and data protection capabilities. Today, traditional SWGs are challenged by the massive shift to cloud IT and remote work. Network perimeters have disappeared, and employees access corporate IT infrastructure and applications via various devices and connections. A SWG must protect against more sophisticated malware, advanced phishing attacks, and other cyber threats and provide visibility into web activity and granular controls for acceptable use. To address these challenges, next generation secure web gateway must be scalable and incorporate advanced capabilities like SSL/TLS inspection, decoding apps, cloud services for contextual analysis, CASB features, data loss prevention (DLP), and more. They also need to be able to handle increasing amounts of encrypted traffic and deliver performance, scalability, and resilience. Next-gen SWGs need a highly efficient and flexible core engine to achieve these requirements.
Next-gen SWGs need to go beyond URL filtering
Traditionally, SWGs have been deployed as hardware or software components on the edge of a network that sits where all web traffic comes in, analyzing it for security and compliance purposes. They enforce security policies and perform SSL/TLS inspections based on URL categories while monitoring return traffic to ensure that employees do not download any malware or threat back into the network. At its core, an SWG scans for specific code and content in network traffic and blocks access to websites or other online resources that do not meet corporate internet access policy. For example, it can block specific sites based on a list of keywords or phrases that might be associated with gambling, pornography, violence, terrorism, etc. The SWG also scans for malicious codes in network traffic, comparing them to existing blocklists of known threats and vulnerabilities. As the world has evolved into a cloud and remote-working world, SWGs have also had to evolve. The traditional network perimeter has virtually disappeared, and IT teams need to be able to protect their data from cyber attacks, whether it is stored on-premises or in the cloud. A next-gen SWG must go beyond URL filtering, providing advanced threat protection, unified data control, and efficiently enabling a remote and distributed workforce. In addition, it must support the secure deployment of cloud applications in conjunction with CASBs.
Next-Gen SWGs Beyond Encryption Inspection
The internet has changed dramatically over the last decade. As a result, traditional secure web gateway (SWG) solutions can’t meet modern IT security needs. They’ve been left behind as IT infrastructure and cloud applications have moved beyond the network perimeter, with employees connecting to them from anywhere in the world via unsecured devices and connections. This shift to a remote-working world strains the SWG, as it must protect against advanced threats and compliance issues that legacy web security technologies weren’t designed to deal with. In addition to inspecting encrypted traffic, a next-gen SWG must provide inline visibility and control of cloud apps and services, granular acceptable use policies driven by app risk, user risk and activity, and contextual threat intelligence. It must have a cloud-scale with globally distributed inspection and cloud performance to ensure that users receive a good experience and don’t face latency or connectivity issues.
Next-gen SWGs need to be cloud-based
While traditional appliances have been the mainstay of secure web gateways, a cloud-based solution is critical in today’s distributed workplace. This is because traditional network perimeters have vanished, with employees accessing data and applications from anywhere and often via personal devices over unsecured connections. A modern cloud-native security platform offers an integrated SWG+CASB+DLP solution that empowers your organization to thrive in this decentralized world. Its direct-to-cloud architecture eliminates the need to backhaul internet traffic to an SWG appliance on your premises. It also reduces network latency by removing multiple hops and unnecessary VPN connections. It also provides:
- Unified management.
- Advanced threat protection and performance.
- A high-capacity global architecture for fast, scalable security.
As a result, it delivers better performance and reduced operational costs by avoiding the need for costly MPLS links. Additionally, it can scale automatically and efficiently to meet growing data security and access control demands. To protect your organization’s data and users from web and cloud-enabled threats, a next-generation SWG must include a wide range of tools such as URL filtering, malware detection, and remote browser isolation. It should also protect data as it moves in and out of the cloud and private apps – even when they’re unsanctioned. The best way to achieve these capabilities is through a unified security platform that delivers complete visibility and granular controls for all your data.