How much does web application security cost (for example Barracuda WAF-as-a-Service)

So, in choosing WAF software, devices, or cloud services, you can be guided by product characteristics, ease of deployment, manufacturer ratings, quality technical support, examples of implementations in other companies similar to yours, and customer reviews using WAF in practice. We tried to uncover these topics in our last post. Hackers are more terrible than they are painted on, or how to protect web applications .

But also an important factor when choosing a product of information security, of course, is the price.

The information security budget, on the one hand, should correspond to the needs and possibilities of your organization, and on the other hand, take into account the real picture of the market supply. To set the search direction, we created a price calculator that will help you choose the right product model in accordance with the parameters of your company. In all the necessary details, we knew the configuration of the Barracuda Web Application Firewall product . Therefore, using his example, we will describe in more detail about the functions and parameters that affect the price of the product.
')
Before you can calculate a configuration, you need to select a deployment model. It can be a hardware or virtual device, a virtual device for a specific service (Amazon Web Services, Microsoft Azure or the Google Cloud Platform) or a cloudy SaaS (for example, Barracuda WAF-as-a-Service ). It all depends on the needs of the organization.

Hardware and virtual devices

As a rule, hardware devices are more powerful. In the case of Barracuda, hardware devices can protect up to 600 servers, while virtual devices can protect only 300.



Technical support is necessarily included in each hardware package. Barracuda also offers Instant Replacement, the replacement of damaged equipment on the next business day.

Virtual devices for services depend on the level of service that you use:


All virtual and hardware devices can be ordered service protection against DDoS-attacks. Since WAF monitors violations of access to web applications, and protection against DDoS - confidentiality violations, their combination provides more reliable protection.

For example, this is the Barracuda WAF hardware device specification for 5-10 servers for 1 year with the DDoS prevention service:



You can independently try to calculate the cost of devices for your company.

WAF-as-a-Service

The advantage of the WAF-as-a-service solution is that it is more flexible: you can choose the exact number of web applications you want to protect and buy a monthly subscription, whereas in devices you can choose only 1, 3 or 5 years. Also the price will depend on the bandwidth for your applications:



Below is a calculation of the price of the Barracuda WAF-as-a-Service product to protect 25 applications with 50 Mb / s traffic for a period of 1 year using the service.



You can create a specification for your company using our Barracuda WAF-as-a-Service autoconfigurator .
We welcome any comments on the topic.