SASE is cloud-based networking and security that is more powerful than old hardware-based firewalls, VPNs, and secure web gateways, etc. SASE provides internet security and zero-trust network access for users regardless of where they work from. SASE also protects IoT devices such as VoIP phones and printers. Finally, SASE can securely connect offices, data centers, and cloud locations together with a seamless cloud network. All these use cases are accomplished through software that is easy to deploy and manage.

Just as Netflix eliminated the need for DVDs and DVD players by streaming videos from the cloud, SASE eliminates the need for security and networking hardware (such as firewalls and VPNs) by delivering highly secure networking from the cloud. SASE consolidates more than five existing devices and services into a single cloud service. Like Netflix, though, SASE does much more than just replace the old services; it adds new capabilities to make it much better. Netflix allows us to watch anywhere on any device, get recommendations, and find obscure shows we love – things that our old DVD players could never do. Similarly, SASE allows users to securely connect from anywhere on any device and protect the user and company data with new capabilities such as zero-trust and data loss prevention. Zero-trust means that each user gets access only to those applications and data they are supposed to access and nothing more, while data loss prevention protects against data being stolen from your company’s systems. These new capabilities are seamlessly integrated into the cloud security service making SASE as simple and enjoyable as a night in with your favorite film.

SASE’s value to clients and MSPs comes from the following characteristics:

1. Better Security through a unified zero-trust platform that delivers multiple security services each with multiple layers of defense. Each service is better integrated and has more capabilities than older security offerings and the multi-service platform makes security adoption and management easy.
2. Easier Compliance by exceeding the network security requirements for all the major compliance standards such as PCI DSS, HIPAA, SOC, etc. Clients can be certain that they meet compliance requirements today and are future-proofed against emerging compliance requirements such as zero-trust. Exium SASE also meets cyber insurance coverage requirements to protect customers against ransomware threats.
3. Agility and Digital Experience are significantly improved by SASE because unlike legacy, box-based security, SASE is built for the cloud with a modern user experience. Users get easier to use security that is built for hybrid work, stays out of the user’s way, and delivers better performance. Your client gets security that works with their cloud and saas apps just as well as it works with their internal data center apps. You, the MSP, get security that is deployed the same way regardless of the location (office, data center, cloud, etc.) and is already integrated unlike the old point solutions that you need to patch together.
4. MSP Multi-tenant Platform. Exium’s multi-tenant platform enables you to manage all of your customers from one place and integrates with existing MSP tools such as ConnectWise Manage, Datto Autotask, Active Directory, and many others. You can use your existing RMM and PSA tools to deploy and support your security offerings. Best of all, you can offer multiple security services from the same platform and expand your revenue base.

SASE enables the following use cases to meet your clients’ security needs:

1. Internet Security. Users connecting to any internet application or website are protected with multi-layered internet security including DNS & URL filters, secure web gateway, intrusion detection & prevention, and malware threat prevention. This service is called Secure Internet Access.
2. Zero-trust Network Access. Users connecting to internal applications hosted anywhere are protected with zero-trust network access that gives them secure access to just the apps they are authorized to use. This service is called Secure Private Access.
3. IoT Security. SASE also protects other devices on your network such as VoIP phones, printers, and cameras. This service is called Secure Things Access.
4. Connecting Sites. SASE can work with your existing SD-WAN service or you can use SASE to connect your locations together – the choice is yours. This capability is included in Secure Private Access above.

Businesses who use SASE can be assured that they are using the latest security technology that is always kept up to date – being cloud delivered means you don’t have to update the versions, it is done automatically. They can also be assured that the service is always-on no matter where their user connects from (they don’t have to be in the office or connect to the office) and that users will only get access to applications and data they are supposed to – nothing more.

The cloud aspect of SASE is reassuring in another way as well. With legacy, hardware-based security disaster recovery can be very difficult if the company’s offices go offline. If all your security is at a few locations that are impacted by some disaster, then your business may stop running. With SASE, disaster recovery and business continuity come built into the service.

Most businesses deploy networks so that their users can connect and be productive and deploy network security so that the business can protect customer data and be compliant with regulations for their industry. Doctors and dentists need to be HIPAA compliant, any business that accepts credit card payments needs to be PCI compliant, and so on. SASE makes it easy to meet your business’s compliance needs while also protecting your business with the latest technology against ransomware and hackers. The benefit to your users is a better experience since SASE works directly from the cloud and delivers better performance than older solutions.

SASE is the future of network security. Just as most applications are moving to the cloud, network security is also moving to the cloud. Clients should not waste money trying to make old security technology work with their cloud applications. Yes, it can work in the short term but the more their apps and data are in the cloud the harder it will be to change later. You can help your clients make their business modern and agile with SASE cloud security.

Exium SASE agents are available for Windows, Mac, Linux, IOS, Android, and chrombooks platforms

Please refer to “Installing Exium Agent using Connectwise RMM”.

https://exium.net/docs/exium-client-windows-deployment-using-connectwise-automate/ 

Yes, “Always Connected” option available in the Admin console
setting& subscription-> profile-> Please select “Yes” for Always ON

This can be achieved with “AlwaysON” option provided on Admin console. On Admin console, Go to profile Sellect “Always Connected” option as Yes.

Encrypted traffic inspection – most websites or traffic is already encrypted. How is Exium performing encryption on already encrypted traffic? They would like as much detail as possible.

When the traffic is encrypted at the app layer (TLS/ HTTPS etc.), Exium still encrypts with IPSec to protect the network layer. For SPA, the IPSec encryption is end-to-end (with IPSec decryption/ re-encryption in the mesh to enforce Zero-Trust, other policies and remove any malware). For SIA, IPSec layer is removed in the mesh before sending traffic to public websites but Network Address Translation (NAT) is applied for privacy so website cannot track the originating IP etc.

The above is the default. However, in select cases and for a subset of Web/ app traffic, based on customer need Exium also activates proxy in the mesh for TLS/ HTTPS inspection ( TLS decryption/ re-encryption). However, we see this becoming more and more difficult with TLS 1.3 and certificate pinning etc. The list of apps that need to bypass TLS/HTTPS inspection to work properly continues to increase.

When activated, Exium’s web proxy in the mesh uses a man-in-the-middle approach. The endpoints need to install a certificate provided by Exium on their browsers. We fully decrypt the SSL/ TLS traffic, scan it for threats and intrusion detection etc., re-encrypt it, and block it or send it to its destination based on if threats or detected or not. Our DLP and other security controls run on the unencrypted traffic.

Regarding applications under advanced policies, currently it is used for split tunnel feature. It takes IP (subnet/mask) which is used to bypass some traffic through plain internet instead over exium (split tunnel)

We have a splash page but currently this page gets loaded only in case of http based websites. In case of https, to show the status window and letting the user know site is blocked, a proxy is required that we plan to provide on select basis later this year. Till then user can be notified using email notifications based on the setting in Alerts page in multi-tenant partner. Screenshot is attached below to enable notifications to user.

Categorization data for Exium Web security and many other Exium products is handled by Exium Intelligence Group. If you believe a domain, URL, IP, or file hash categorization reported in Exium to be incorrect, please submit a ticket to the Exium support team at support@exium.net to have this categorization reviewed for adjustment.

Exium solution built on 5G Network Tech:
Better Performance through integrated 5G acceleration, QoS, and single-pass architecture
Better Security from hardware root of trust, standards-based trust model (vs. proprietary), increases transparency , and integrated network awareness
Security stays up to date through 5G industry R&D spend
Native (no agent required) on 5G devices
 

This feature is enabled by default when a customer subscribes to SIA or SPA (firewall included in both). If you have been testing Exium service, you can go to SIA or SPA dashboards, scroll down, and you will see the Firewall logs 

Alerts are important notification sent to MSPs on customer workspace activity.

• Threat Alerts – Whenever Exium Threat Intelligence platform detects threat, that is shown in dashboard and as well sent as an alert. Channel can be Email or Connectwise PSA. This indicates, that alert is sent as either an email or ticket in Connectwise PSA. Please see following image for Channel type, and other options
• PM Alerts – Platform sends this alert whenever policy violation is detected 
•  Client connection status Alerts – Alerts if user disconnects client. This is for admin to make sure all users are always connected and protected
• Anomaly detection Alerts – Alerts Anomaly detected in user behaviour – i.e. location anomaly , different location from user regularly operates 
•  Gateway connection status  – Alerts if Gateway(CGW)  is disconnected  Subscription Limit Notification – Alerts if subscription limit is reached 

 Based on these alerts, MSP can take different remedy actions.

You can find the Exium's privacy policy at https://exium.net/privacy. If you have any questions about the privacy policy , please reach out to your Exium contact or hello@exium.net.

Our products enable our customers to grant their authorized users direct, secure access to the internet or specific applications from anywhere and from any device. Therefore, our products use personal information like context-based identity to ensure that our customers can guard against intruders and authenticate their authorized users’ access requests.

Exium stores a limited amount of personal data (e.g., IP addresses, URLs, user IDs, user groups and departments from corporate directory) and does not process or store any special or sensitive categories of personal data (e.g., credit card or protected health information).

Yes, cookies allow us to remember you, enhance your experience on our website, and offer you relevant products and services. We use cookies to facilitate site navigation, monitor responses to our advertisements, and continually improve our website design and functionality for account holders and visitors.

Exium will process tokenized and encrypted user data in one of our 155+ global Cybernodes (data centers) located closest to the customer’s users, meaning the customer has control over which data centers to use or not, depending on where the customer has users (e.g., EU data centers for EU users, US data centers for US users). If an EU user travels to the US, Exium will process the user’s personal data from the closest data center, which would be in the US. 

Even if a customer only has users in the EU, Exium provides global support services not only from the EU, but also from the US, and India, to ensure 24/7/365 coverage. This is a common practice among most cloud vendors.

Customer logs are the records of network traffic metadata collected and stored for each transaction. Administrators can access and review customer logs via the Admin Portal to authenticate customers’ users web requests. Customer Logs have various fields that may contain personal data, like Device Owner, User, Hostname, etc.

Customers will be notified of material changes to our Privacy Policy by email and/or through a posted notice on the Exium Website before the changes go into effect. Please note that your use of the Website, the Content, or the Products after the posting of such changes constitutes your consent to such changes.

If Exium becomes aware of a data breach, Exium will notify affected customers without undue delay after confirming the incident. Exium will take reasonable steps to (a) identify the cause of the Security Incident and (b) take any actions necessary and reasonable to remediate the cause of such Security Incident to the extent such remediation is within Exium’s reasonable control.

Exium adheres to rigorous security, availability, confidentiality, and privacy standards so customers can adopt our services with confidence.

Our compliance team works to ensure all Exium products are aligned with and certified against internationally recognized government and commercial standards—frameworks to build customers’ confidence by providing pertinent solutions.

Exium is certified under ISO 27001 and System and Organization Controls (SOC) 2 Type II standards and is audited annually by a third party to ensure ongoing compliance with these certifications. Exium regularly tests, assesses, and evaluates the effectiveness of its security measures. Upon written request, and subject to appropriate confidentiality protections being in place, Exium can provide customers with a copy of its most recent ISO 27001 certificate and/or SOC 2 Type II report.

We process and store Personal Data only for the period necessary to achieve the purpose of the storage, or as permitted by law. The criteria used to determine the period of storage of information is the respective statutory retention period. After expiration of that period, the corresponding information is routinely deleted as long as it is no longer necessary for the fulfillment of a contract.

Yes, the Exium board of directors has oversight responsibilities for all enterprise risks, including privacy. The Board delegates some of that responsibility to standing committees that report back to the full Board. The Audit Committee and the Nominating and Corporate Governance Committee are each tasked with overseeing privacy risks and cybersecurity threats.

Privacy is paramount throughout Exium. We require our employees and contractors to complete privacy and security training during onboarding and refresh the training annually.

Exium is committed to maintaining compliance and carefully monitors the development of privacy legislation and regulations in various countries.