How Can SASE Help Organizations Address the Growing Threat of Ransomware Attacks?

Published on: February 15, 2024

.

11 min read

Ransomware attacks have crippled enterprises across industries. High-profile assaults on Colonial Pipeline and JBS Foods in 2021 made headlines, but hundreds of smaller companies are targeted every month. The assaults begin when a cybercriminal obtains early access to a network and installs malicious programs that crawl the network and encrypt data, prohibiting legal use. The attackers then demand hefty amounts in nearly untraceable Bitcoin transactions before giving the victim the tools to decode the data and regain access.

The secure access service edge (SASE) approach to cybersecurity is critical for defending today's networked information systems. This growing security policy acknowledges that enterprises today have users who work from home, on the road, and in other distant places. Those same customers are likely to employ a range of cloud-based services to fulfill their business objectives, rather than simply accessing information housed in secure corporate data centers. In this scenario, it is no longer required or prudent to route all distant user traffic through a single data center.

SASE solutions help to defend networks from ransomware threats by encrypting data that passes between an endpoint and internet-connected services. For example, a SASE solution may identify and prevent a malicious payload from being downloaded to a client device, as well as prevent a client from connecting to known ransomware and bot command-and-control servers.

In this post, our headlines on how SASE prepares for the ransomware threat attack and its influence on this issue are as follows:

• What are Ransomware Attacks?
• How Does SASE Enhance Network Security to Prevent Ransomware Infiltration?
• In What Ways Does SASE Improve Threat Detection and Response for Ransomware Incidents?
• Can SASE Solutions Enhance Data Backup and Recovery Strategies to Mitigate Ransomware Risks?
• What Role Does SASE Play in Securing Remote and Branch Offices Against Ransomware Threats?
• How Does SASE Facilitate Secure and Encrypted Communication to Prevent Ransomware Interception?
• In What Ways Does SASE Address Insider Threats as They Relate to Ransomware Incidents?
• Can SASE Solutions Assist in Maintaining Business Continuity During Ransomware Incidents?
• What Are the Key Considerations for Integrating SASE into an Organization's Ransomware Preparedness Plan?
• How Can SASE Solutions Aid in Secure Access Control to Prevent Unauthorized Ransomware Attacks?
• What Are the Benefits of Cloud-Based SASE Solutions in Combating Ransomware Threats?

What are Ransomware Attacks?

Ransomware is a type of software that encrypts files on a computer and prevents users or organizations from accessing them. A user's or organization's vital data is encrypted, making it impossible to access files, databases, or apps. A ransom is then required for access. Ransomware is frequently intended to propagate throughout a network, targeting database and file servers and swiftly paralyzing an entire enterprise. It is a rising concern, resulting in billions of dollars in payments to hackers while causing substantial harm and costs for businesses and government agencies.

Ransomware has swiftly emerged as the most prevalent and obvious sort of malware. Recent ransomware attacks have hampered hospitals' capacity to perform critical services, paralyzed public systems in cities, and caused severe harm to a variety of enterprises.

What are the Damages of a Ransomware Attack?

A successful ransomware attack might have many consequences for an organization. Some of the most prevalent ransomware dangers are as follows:

• Financial Losses: Ransomware attacks are intended to coerce victims to pay a ransom. Companies lose money as a result of the infection's remediation expenses, lost business, and possibly litigation fees.
• Data Loss: Some ransomware attacks encrypt data as part of the extortion process. Even if the firm pays the ransom and obtains a decryptor, data loss is a common outcome.
• Data Breach: Ransomware gangs are increasingly using multiple or triple extortion attempts. These assaults include data theft, possible disclosure, and data encryption.
• Downtime: Ransomware encrypts sensitive data, and triple extortion attacks may include DDoS. Both of these have the potential to generate operational downtime for a business.
• Brand Damage: Ransomware attacks may hurt a company's reputation among consumers and partners. This is especially true if client data has been compromised or they have received ransom requests.
• Legal and Regulatory Penalties: Security carelessness can enable ransomware attacks, which can result in the loss of sensitive data. This may subject a corporation to litigation or penalties imposed by regulators.

How Does SASE Enhance Network Security to Prevent Ransomware Infiltration?

Secure access service edge (SASE) is one cutting-edge method that combines enhanced security and networking into a single solution. IT teams can build a more durable, dependable, and trustworthy network infrastructure with SASE to run effectively, safely, and to best serve users. In order to provide contextual security based on user, role, device, application, location, security posture of the device, and content, advanced SASE solutions integrate security services like Virtual Private Network (VPN), Secure SD-WAN, Edge Compute Protection, Next-Generation Firewall (NGFW), Firewall as a Service (FWaaS), Secure Web Gateway (SWG), and Zero Trust Network Access (ZTNA) tightly.

Advanced SASE systems provide a plethora of security features to assist enterprises in combating the persistent danger posed by ransomware. For instance, companies may find out if a file has any suspicious content or harmful code by using tools for static and dynamic analysis. These features are provided by SASE as part of its Firewall as a Service (FWaaS) or IPS engine. The file content analysis solution automatically examines a file to see if it includes any dangerous material as it leaves the user's computer and travels via a SASE edge gateway and the internal network.

Organizations can ascertain whether lateral movement or other activities are taking place inside the network with the use of anomaly detection, analytics, and network traffic. As part of SASE, these network traffic anomaly detection systems look for any odd network behavior that can raise a red signal for potential ransomware.

SASE provides IPS and other network monitoring services. These services utilize heuristics or signatures to identify the most recent risks and irregularities in the network, such as ransomware's use of lateral movement to spread throughout a network. In order to help an organization properly understand its network and the divisions within it, as well as to apply certain security policies and permissions depending on the network dynamic, it provides network visibility and analytics.

SASE sets up suitable network settings for users, workstations, and laptops to limit access and prevent a broad ransomware assault. Zero Trust networking and the idea of least privilege, which grants users just the privileges necessary to accomplish their obligations on that system, are enabled by SASE. The primary tactic used by ransomware is network invasion and lateral movement to steal important data. SASE aids in averting this.

In order to establish the foundation for the ransom demand, SASE employs a variety of methods and instruments to compromise computers, networks, and applications. Your first line of defense against attackers should thus be a Secure Access Service Edge (SASE) solution that focuses on safeguarding these assets from ransomware.

In What Ways Does SASE Improve Threat Detection and Response for Ransomware Incidents?

Threats may be identified and avoided using AI in a variety of ways. It may be used, for example, to recognize harmful traffic patterns that have never been observed before, categorize malware, stop illegal access attempts, and stop data breaches in milliseconds. By examining and contrasting language, brand, and other visual information, as well as email flows from websites purported to have phishing linkages, it can assist in thwarting phishing efforts. Because the SASE cloud collects data from thousands of users, artificial intelligence (AI) is able to identify phishing messages and URLs more quickly than traditional security technologies, shielding businesses against phishing scams and fraudulent breaches.

Following the discovery that thirty percent of feeds miss IoCs or include false positives, SASE aggregates records and assigns a score using machine learning and artificial intelligence. Zero-day attacks may be carried out using these worldwide libraries of machine learning and signatures. Additionally, SASE can quickly and effectively compile a database of well-known offenders from online sources for on-demand blocking.

SASE solutions offer a single security environment that helps shield schools and institutions against ransomware. The first step in doing this is having complete visibility over all network traffic, regardless of its source or destination. SASE enables various security solutions to operate together, as opposed to firewalls acting as a single line of defense and passing along attacker information to other solutions on the network.

Furthermore, enterprises must deploy vital technologies like Secure Web Gateways, SASE, and ZTNA for secure application access in order to extend malware protections to their remote and mobile workers, even though new advanced endpoint technologies like EDR (endpoint detection and response) can identify malicious ransomware based on behavior in addition to threat intelligence.

To put it simply, the SASE security paradigm defends several attack vectors at once, which helps avoid ransomware.

A SASE client connecting to the SASE gateway is scanned for health issues by SASE's Host Information Profile (HIP). To determine the health condition of the client, a number of parameter checks are performed, such as the patch level, OS version, registry settings, availability of an updated antivirus engine with signatures, monitoring of running processes and services, etc. The SASE gateway can enforce restrictions like blocking access from the host or putting it in a quarantine network based on the scan findings.

Last but not least, sophisticated SASE systems have a URL reputation function that keeps track of and alerts users if any SASE client processes make contact with a bad site.

Can SASE Solutions Enhance Data Backup and Recovery Strategies to Mitigate Ransomware Risks?

Yes, with certain features and tools, SASE solutions improve data backup and recovery methods to reduce ransomware risks.

Whether assets are located in the cloud, in central data centers, or through hybrid arrangements, data protection is an essential duty for every business network. SASE includes a variety of data loss prevention (DLP) methods to increase data security in transit and at rest.

Safe authentication processes allow users access in more ways than just password security. SSO portals and multi-factor authentication (MFA) offer strict control over who can access private information.

SASE primarily combats ransomware in four crucial areas: Producing meaningful and practical data reports to reduce potential risks and improving backup and recovery tools

SASE enables cybersecurity teams to apply restrictions to end-user devices that utilize cloud services, improving the user experience while preventing data breaches within the business.

Along with improved cloud-delivered network security features like secure web gateways, cloud access security brokers (CASB), data loss prevention (DLP), firewalls as a service, and zero-trust network access to support the dynamic secure access needs of digital transformation, SASE technology makes branch-to-branch and branch-to-central network connectivity over extremely complex and comprehensive WAN technologies simpler.

What Role Does SASE Play in Securing Remote and Branch Offices Against Ransomware Threats?

SASE primarily combats ransomware in two main areas: enhanced identification for identifying questionable traffic and activity and, more crucially, adaptable remote operations and control.

Users likely use a range of cloud-based services in addition to information kept in secure corporate data centers to accomplish their business goals. In this case, routing all distant user traffic through a single data center is no longer prudent or necessary.

SASE serves as both an endpoint and a defensive layer. By protecting distant users' and branch offices' access to the corporate network and the internet against known and unknown zero-day ransomware attacks, a SASE solution acts as a first line of protection.

By enabling identity-based remote network access, SASE is essential to the enforcement of zero-trust regulations. In conjunction with other security technologies, it restricts authorized users' access to the network and their ability to do certain tasks within the parameters of their security profiles.

Today's dispersed information systems are mostly protected by the secure access service edge (SASE) approach to cybersecurity. Organizations today have users working from home, on the road, and in other distant places, which is acknowledged by this developing security policy. In order to accomplish their business goals, those same customers most likely employ a range of cloud-based services in addition to the data kept in secure corporate data centers. It is no longer prudent or required to route all traffic from remote users through a centralized data center in this scenario.

By moving the execution of security policies off the corporate network and onto the users' local devices, SASE technology facilitates remote work and cloud-based services. Regardless of the device's physical location or network access, end-user devices and other security tools comprehend and consistently implement the organization's security standards. Because remote users are held to the same security standards as those utilizing corporate network equipment, technology teams can now rest easy.

How Does SASE Facilitate Secure and Encrypted Communication to Prevent Ransomware Interception?

SASE's native intrusion prevention system (IPS) almost minimizes false positives due to its omnipresent visibility across networking and security events. In a SASE architecture, the IPS can employ machine learning and artificial intelligence (AI) to correlate networking data, such as the target domain or IP's history with genuine traffic, with indications of compromise (IoC) from threat intelligence feeds in order to detect false-positive alarms.

The IPS can prevent attackers from remotely distributing ransomware to computers. However, a system may still be hacked by other attack channels, such as an infected USB drive. Once the payload is delivered, the ransomware will attempt to connect to the command-and-control server in order to interact with the attackers, acquire more instructions, exchange encryption keys, and/or exfiltrate data. Ransomware often encrypts data only after this transaction occurs.

SASE's IPS has a comprehensive picture of network events as well as information about the target IPS's reputation. It can detect and then prevent such efforts to interact with command and control services. For variations that encrypt local storage immediately, the IPS identifies the ransomware's attempts to encrypt network-attached storage using the server message block (SMB) protocol. SASE's IPS stops the ransomware from changing file extensions or leaving a ransom note. It offers unique access to data and the ability to identify malware based on network activity patterns.

Another feature of ransomware is that it is meant to spread laterally throughout the network, compromising as many linked devices and data as possible. Once entered, ransomware may roam freely without further verification using a standard perimeter security strategy.

SASE's zero-trust approach to application and resource access assures that users and hosts can only access what they are specifically permitted to, with authentication occurring for each access request. All network traffic is continually monitored for abnormalities and harmful activity, such as attempts to access unauthorized resources. This restricts the attack surface and confines the ransomware to its first target if it manages to get inside. In this manner, ransomware cannot encrypt substantial amounts of data.

In What Ways Does SASE Address Insider Threats as They Relate to Ransomware Incidents?

SASE relies on threat information inputs from open-source, collaborative communities, and commercial vendors. In addition, after discovering that 30% of feeds include false positives or miss IoCs, SASE aggregates and scores records using ML (machine learning) and AI. These worldwide signature-based and machine-learning repositories can be used for zero-day assaults.

A SASE advanced anti-malware solution uses machine learning to guard against unknown threats and zero-day assaults. It is especially beneficial against polymorphic malware that attempts to circumvent signature-based inspection engines. SASE can quickly and robustly compile a blacklist of known offenders from Internet sources for blocking on demand.

Advanced SASE solutions provide a wide range of security features to assist enterprises in dealing with continuous ransomware threats. For example, static and dynamic analysis tools help businesses determine whether a file is suspicious or includes harmful code. SASE provides these features as part of its IPS engine or Firewall as a Service (FWaaS) capability. When a file exists on a user's system and enters a SASE edge gateway and the internal network, the file content analysis solution immediately checks to see whether it includes anything harmful.

Network traffic analytics, analysis, and anomaly detection assist enterprises in determining whether or not there is lateral movement within the network. These network traffic anomaly detection technologies, as part of SASE, evaluate whether there is any unexpected network behavior that might be interpreted as ransomware.

SASE provides intrusion prevention systems (IPS) and other network monitoring services that employ signatures or heuristics to identify the most recent threats and network irregularities, such as lateral movement, which ransomware exploits to spread across networks. It provides network visibility and analytics, allowing an organization to better understand its network and its segmentation, as well as implement unique security policies and permissions based on network dynamics.

Can SASE Solutions Assist in Maintaining Business Continuity During Ransomware Incidents?

Yes, SASE may aid with the continuation of processes in a company during a ransomware attack, such that initially ensuring business continuity in the event of a ransomware attack is a multidimensional task that includes deploying pre-existing protection measures, incident response planning, cyber insurance, and trustworthy backups, all of which play critical roles in protecting your company's operations. By taking a proactive approach, you can lower the likelihood of a ransomware assault hurting your firm.

Actually, there is no cure for ransomware. When there is no treatment, the only effective measures are prevention and containment. Even that demands ubiquitous security with global visibility and ongoing monitoring, the cloud-native qualities of SASE (secure access service edge), may help enterprises construct a multilayered defense for battling ransomware in three ways:

1. Prevention: Improving Threat Intelligence Feeds.

   Threat information feeds from open-source, collaborative communities, and commercial suppliers can help detect common ransomware and attack patterns. However, even high-quality feeds produce an astonishing number of false-positive warnings. Frequent false positives fatigue security professionals and may cause delays in responding to actual ransomware alarms.

   SASE's native intrusion prevention system (IPS) almost minimizes false positives due to its omnipresent visibility across networking and security events. In a SASE architecture, the IPS can employ machine learning and artificial intelligence (AI) to correlate networking data, such as the target domain or IP's history with genuine traffic, with indications of compromise (IoC) from cyber threat intelligence feeds in order to detect false-positive alarms.

   Although typical anti-malware protects against known ransomware strains using global threat intelligence databases, SASE's anti-malware component goes a step further. It has a consistent picture of all user and location data to define baselines and acceptable behavior patterns. It then connects this data with machine learning and AI to detect and prevent zero-day threats and polymorphic malware.

2. Detection: Identifying and Blocking Suspicious Activities.

   The IPS can prevent attackers from remotely distributing ransomware to computers. However, a system may still be hacked by other attack channels, such as an infected USB drive. Once the payload is delivered, the ransomware will attempt to connect to the command-and-control server in order to interact with the attackers, acquire more instructions, exchange encryption keys, and/or exfiltrate data. Ransomware often encrypts data only after this transaction occurs.

   SASE's IPS has a comprehensive picture of network events as well as information about the target IPS's reputation. It can detect and then prevent such efforts to interact with command and control services. For variations that encrypt local storage immediately, the IPS identifies the ransomware's attempts to encrypt network-attached storage using the server message block (SMB) protocol. SASE's IPS stops the ransomware from changing file extensions or leaving a ransom note. It offers unique access to data and the ability to identify malware based on network activity patterns.

3. Containment: Preventing lateral movement.

   Another feature of ransomware is that it is meant to spread laterally throughout the network, compromising as many linked devices and data as possible. Once entered, ransomware may roam freely without further verification using a standard perimeter security strategy.

   SASE's zero-trust approach to application and resource access assures that users and hosts can only access what they are specifically permitted to, with authentication occurring for each access request. All network traffic is continually monitored for abnormalities and harmful activity, such as attempts to access unauthorized resources. This restricts the attack surface and confines the ransomware to its first target if it manages to get inside. In this manner, ransomware cannot encrypt substantial amounts of data.

What Are the Key Considerations for Integrating SASE into an Organization's Ransomware Preparedness Plan?

A holistic strategy builds a robust barrier by proactively recognizing and reducing ransomware risks, and ensuring the security and availability of digital assets.

The foundation of ransomware defense layers is critical to establishing a safe baseline in the digital world. Here are these levels and how SASE may assist an organization in preparing for attacks:

• Enhanced Authentication: Prevents unwanted access by validating user identity. SASE adheres to zero trust principles by enabling identity-centric access and enforcing security policies based on user and device characteristics. As a result, only authorized users with trusted devices, independent of location, have access to specified programs or data.

• Advanced Anti-Malware Solutions: Uses advanced tools to detect and eliminate malware. Protecting sensitive data is a top priority for your company, and you must monitor and manage the material that travels into and out of your network.

  Security services like data loss prevention, real-time URL filtering, and content inspection are built right into the cloud architecture of SASE. Moreover, in SASE, you can impose controls that prohibit unauthorized transfers of sensitive data and scan material for malware or other dangers.

• Comprehensive Network Security: SASE combines security and networking capabilities, it may streamline IT and security operations by providing visibility and centralized management. Security services are deployed at the edge to ensure that all traffic, whether sent to the internet or the corporate network, is consistently safeguarded.

Apart from all this, the Secure Access Service Edge not only secures your apps and sensitive data but also lets your network function more effectively while providing additional security benefits.

Secure access service edge (SASE) provides a solution to these increasing difficulties by combining the networking capability of a software-defined wide area network (SD-WAN) with zero-trust network access and other cloud security characteristics.

SASE enables you to improve your organization's network security while simplifying dispersed network access.

How Can SASE Solutions Aid in Secure Access Control to Prevent Unauthorized Ransomware Attacks?

Because technology is always improving, it is critical to adhere to fundamental cybersecurity standards and be proactive to ensure that you or your organization are never vulnerable to ransomware threats.

Control access to critical data with access control solutions including two-factor authentication, role-based access, and privileged access management. This reduces the likelihood of ransomware attacks spreading throughout your network. All of this network security is simply achieved with SASE. A SASE (secure access service edge) architecture combines networking and security as a service capability to provide a single cloud-delivered service at the network edge. This allows a company to automatically accommodate scattered remote and hybrid customers by connecting them to nearby cloud gateways, rather than backhauling traffic to corporate data centers. It ensures consistent, secure access to all apps while providing complete visibility and inspection of traffic across all ports and protocols.

SASE isn't the only security framework that has made progress in recent years. The Zero Trust framework is worth highlighting since it requires all users and devices to be continually verified and validated before being granted access to IT resources inside a network. This approach is opposed to previous network security techniques, which assumed that anybody or anything within the protected network perimeter was trustworthy.

However, it is not necessary to choose between a SASE and a Zero Trust architecture; rather, any SASE platform worth considering will integrate Zero Trust Network Access (ZTNA) concepts. The combination of these two ideas forms the basis for future-proof data security measures. That is why SASE Solutions provides the best secure access control to avoid unwanted ransomware attacks.

What Are the Benefits of Cloud-Based SASE Solutions in Combating Ransomware Threats?

The move to remote work has prompted businesses to rethink their network and security infrastructure. The dispersed enterprise has distinct business requirements, and many firms are looking at cloud-based services and Secure Access Service Edge (SASE) to address these demands. From this perspective, the advantages of cloud-based SASE solutions in combating ransomware threats are as follows:

• Quick network access for every user, any device, and anywhere: Over 80% of respondents to research on Remote and Hybrid Work Security have witnessed a growth in remote work since COVID-19, with 66% employing cloud-based security services to expand remote access. Enterprises have several alternatives for connecting distant people to corporate applications and the Internet due to a large network of cloud Points of Presence (POP) and the widespread availability of cloud apps and services.

  Earlier approaches of backhauling branch-office and distant user connections to security stacks at corporate offices, then to the cloud, introduced substantial delay and resulted in poor user quality of experience. With the introduction of software-defined WAN (SD-WAN), organizations improve distant site and user connections to cloud or on-premises resources by determining the appropriate network path for the application. This might be a virtual private network (VPN) or multiprotocol label switching (MPLS) connection back to a corporate network, or a direct-to-Internet broadband or wireless connection via a local Internet breakout on the SD-WAN device.

  SD-WAN is an excellent choice for branch office connections; however, many users work from home and do not have a company-owned SD-WAN router. Support for BYOD devices was one of the most common remote work problems. 40% identified BYOD as a key administrative problem, followed by scaling performance (46%), and privacy and compliance (42%). Zero trust network access (ZTNA) securely links distant users and offices to the Internet and business applications. ZTNA enhances speed by bringing the security stack closer to the user and the application when offered as a cloud service.

  In addition to enhancing speed, a clientless ZTNA solution addresses the BYOD issue. Access to corporate apps is provided through a browser when the user is firmly authenticated using multi-factor authentication (MFA). Then access to Remote Desktop, SSH, web-based software, and database applications is provided only when necessary.

  A VPN is another option for connecting faraway users, but, VPN difficulties were one of the most common customer complaints (62%). Another concern with VPNs is that they provide an authenticated user with complete network access, increasing the company's attack surface and making it vulnerable to cyberattacks. When combined with an SD-WAN or SASE solution, ZTNA provides the option to integrate zero trust into a remote access solution, limiting remote workers' network access to just what they really need for their business.

• Consistent and unified security: According to research on Remote and Hybrid Work Security, over half (45%) of IT and security experts perceive an increase in cyberattacks since the transition to remote work. The top worries were data loss (55%), phishing (51%), and account takeover (44%). Enterprise IT security experts are aware of advanced on-premises security solutions such as secure web gateways (SWGs) and next-generation firewalls (NGFWs) equipped with phishing and zero-day threat sandboxing capabilities. Prevention is perhaps more important for securing a remote workforce than it is for securing on-premises employees.

  Consider a security solution that detects but does not prevent threats. If a user is on-premises, the enterprise's network is most likely segmented, allowing it to immediately isolate the infected host, which may be only a short walk from the support desk.

  When a worker is remote, access to the infected host can be restricted, but the time required to fix the infected host and bring the worker back online increases significantly. A secure SASE solution provides the same degree of threat avoidance for both remote and in-office personnel.

  The zero trust security approach considers data to be the new perimeter, as represented in the study. 55% of respondents indicated data exfiltration and leakage was one of the most common breach and attack routes since Covid-19 forced a move to remote employment.

• Flexible, and efficient delivery of security and network services: SASE integrates or consolidates numerous security and network services under a single umbrella.

  SD-WAN optimizes the delivery of wide area networks (WAN) by specifying business purposes in software, allowing for optimal path selection for the various applications' traffic that flows over the network channels accessible on the WAN. Cloud orchestrators handle network service policies centrally, as well as the zero-touch delivery of network equipment. Zero-touch deployment eliminates the requirement for on-site technical personnel. Boxes are simply connected and switched on, after which they receive configuration and policies from the cloud orchestrator.

  This flexible, agile, and effective delivery of network services extends to security when supplied from a cloud security service edge. The distant branch device is simply set up to connect securely to a local cloud security service edge over a VPN tunnel. In the network policy, traffic to the Internet that requires security can be routed over the VPN to the cloud security service. The same may be accomplished with apps installed on remote PCs and mobile devices.

  Centralizing network and security policy management not only reduces costs but also improves efficiency. It reduces the time required to provide network and security services to remote sites and users. Any necessary updates are done in the cloud and deployed to remote sites and users, eliminating the need for on-site technical assistance.

Because network and security are centrally controlled and choreographed, network and security administrators who monitor the organization's WAN and security may see network health as well as threats to remote locations and users. This allows them to respond more swiftly to network threats and problems as they arise. According to 61% of respondents in the Remote and Hybrid Work Security Report who have switched to cloud-based security, scaling remote access is extremely strategic.