What Does "Secure by Default" mean for Security Service Edge solutions?

Security Service Edge (SSE) Mini-Test Results

The security level of SSE products in their default configuration varies significantly. While many enterprise customers expect these products to reduce operational complexity by being plug-and-play, the reality is that the default security achieved with such a deployment may not be sufficient to meet their specific needs.

Key Findings

• The level of security offered by default varies greatly across SSE vendors. Three out of seven SSE vendors tested offered no security by default.
• In some cases, minor changes from a vendor’s supplied default configuration dramatically improved the security posture of an SSE solution. We observed improvements in malware blocking from 0% to >90% on average.
• SSE customers should not assume any level of security by default without verification.
• SSE customers should understand where the SSE they use stands by default, and whether that default offers the required level of security for their environment.
• SSE customers should not assume any level of security by default without verification. SSE customers should understand where the SSE they use stands by default, and whether that default offers the required level of security for their environment.

Background

SSE solutions are a subset of Secure Access Service Edge (SASE) that focus primarily on security services delivered through the cloud. SSE encompasses critical security functions such as Secure Web Gateways (SWG), Cloud Access Security Brokers (CASB), and Zero Trust Network Access (ZTNA), which work together to protect users, devices, and applications across distributed networks. By shifting these security functions to the cloud, SSE solutions improve flexibility and scalability, enabling enterprises to enforce security policies regardless of user location or device. SSE is particularly beneficial for organizations with a remote or hybrid workforce, as it provides consistent protection against threats, controls access to cloud services and ensures data security without relying on traditional network boundaries.

Introducing “Mini-Tests”

The goal of this first iteration of CyberRatings’ SSE Mini-Test was to derive some empirical data to help answer the question: “Are SSE products secure by default?”

This mini test intentionally did not constitute a comprehensive security evaluation of the full capabilities or overall effectiveness of the vendor platforms. Instead, it focused on a data driven “quick look” at the default posture as delivered by vendors, and with minimal to no additional security configuration of the SSE. The idea was to test the initial basic functional working state. The results of this particular mini test should not be construed as representative of the overall effectiveness or capabilities of the SSE platforms tested.

Why We Tested

There is a notable shift in the industry towards “secure by default” approaches to developing and deploying cybersecurity products. Research indicates that most customers expect cybersecurity vendors to ship with a high level of protection enabled by default. CISA’s publication states the following:

“Secure-by-Default” means products are resilient against prevalent exploitation techniques out of the box without additional charge. These products protect against the most prevalent threats and vulnerabilities without end-users having to take additional steps to secure them. Secure-by-Default products are designed to make customers acutely aware that when they deviate from safe defaults, they are increasing the likelihood of compromise unless they implement additional compensating controls.

A secure configuration should be the default baseline. Secure-by-Default products automatically enable the most important security controls needed to protect enterprises from malicious cyber actors, as well as provide the ability to use and further configure security controls at no additional cost.

Test Methodology

For each of the vendors tested, we performed the following tests using Windows 11 clients configured with the vendor’s SSE client software:

• Test 1: Download ~1,000 benign samples over HTTP designed to be susceptible to being classified as malware despite being innocuous (e.g. the solution’s propensity for triggering false positives).
• Test 2: Download ~3,000 active malware samples, current to within 30 days of the test, over HTTP (e.g. the SSE’s ability to detect and block basic malware downloads). There were no evasions applied.