Barracuda Web Application Firewall vs. F5 Distributed Cloud API Security

Easy to use and reliable, with very little maintenance required and zero downtime to date. For the education sector, ease of use is hugely important as IT Managers/Technicians are often "Jack of all trades" with a good, broad general knowledge but perhaps lacking specific expertise in certain aspects. Being provided with easy-to-follow tutorials and instructions has been very useful in setting up and configuring the firewall, especially as my background is more in desktop support.

Incentivized

I believe it covers everything related to the applications' security aspects, but there are a lot of improvements that need to be made. For example, better granular controls like bot categories listed on the distributed console and a granular URL-based control for the rate-limiting option are needed.

Incentivized

• Attack patterns are regularly updates through contents via Barracuda Web Application Firewall update servers
• Bot Protection has a good line feature to verify between the genuine clients like browsers and bots
• Dos Protection also good level of protection to mitigate Layer 7 attacks
• Allow Deny Rules provides a lot of granular controls to allow and deny the traffic
• URL profiles has a very granular control to mitigate false positives
• Parameter profiles has a very granular control to mitigate false positives
• Risk score feature for the clients to mitigate attacks is also very good feature
• Client fingerprint module can be used against malicious user to enhance security
• Separate XML and JSOn profile for all the URL profiles of the application is plus
• API security is very much effective and shadow API can also be identified

• It auto-discovers APIs, even the ones engineers forget to document. Then profiles them without needing changes to our codebase.
• Shadow API exposure.
• It's pretty decent at abnormal behavior detection.

Incentivized

• STM crashes sometimes happen due to unusual traffic pattern
• Obfuscation on the client side user credentials which appears in the developer tools of browser
• URL Profiles redundancy during the learning of traffic needs to be fixed
• Dos Protection should be more granular like escalation period to throw JS challenge, Captcha and rate limit when escalation period hits until the WAF stops the attack
• Client Fingerprinting should work as expected when verifying the clients as in rare some scenarios, it creates issues

• More accurate detection of advanced persistent threats (APTs) targeting APIs.
• A greater emphasis on checking APIs' schema and contract may prevent them from accepting misconfigurations or malicious input.
• More customized, dynamic, and targeted protection for high-value APIs or high-risk user groups.

Incentivized

F5 Distributed Cloud API Security provides robust API protection with solid threat detection, excellent visibility, and seamless integration into our architecture

Incentivized

-User friendly interface for quick learning -Quick deployment for deploying applications -Easy to manage for naive -System components and upgradation of the WAF is very easy go with -Back restoration is very to make it up and ready anytime -Seperate JSON and XmL profiles for each URLs of the application is plus -Amazing and world class support engineer in comparison other vendors and always available to support -Quick resolution on bugs with their patch applying process

Great product. Working with F5 for many years, we found the products F5 provided are all cutting edge technology. Although in F5 Distributed Cloud API Security we still have a lot to find out, but we believe this experience will be very good. Especially on the security side. Trust in F5.

Incentivized

Always available

Incentivized

The UI is cloud-native and generally responsive. Report generation is easy Integrates with cloud providers

Incentivized

The Barracuda Web Application Firewall is easy to use. Support from Barracuda is great also. Load Balancing of the Web Application Firewall is also nice. This allows you to do maintenance or have large loads for the end-user. Threat monitoring of our network and traffic coming into our services within our cloud solution.

Incentivized

Lo hacemos mediante un partner We did it through a partner

Incentivized

F5 Distributed Cloud API Security is our company looking forward product. With more and more API is using in both on prem, private cloud, public cloud and multi cloud environment, we as a financial institution, we are keep into the security settings to protect the information. That's the main reason we want to use this product.

Incentivized

We have been using their Backup products especially Backup Appliances and legacy products like Intronis. We are also using their Cloud Backup Solutions for O365. This is the reason we opted for this product.

We ran a short POC with Salt. Its data classification and attack replay features were impressive. What held us back was the limited support for hybrid deployments and poor integration into our CI/CD pipelines, as F5 did.

Incentivized

Centralized policy management: You can manage API security policies consistently across locations without duplicating effort, which supports scaling.


API discovery and monitoring at scale: It automatically discovers APIs and monitors them in real time across large and complex environments.

Incentivized

• Much better response times for remote transactions
• 4 year refresh cycle included with active support contracts
• More expensive than traditional firewalls (however its superior to those, not apples to apples)

Incentivized

• F5 Distributed Cloud API Security mitigates many API-related security threats, including bot attacks, DDoS, data breaches, and unauthorized access attempts.
• F5 Distributed Cloud API Security uses robust threat detection, machine learning, and real-time monitoring for speedier identification.
• Reductions in security events result in fewer breaches, reduced downtime, and lower attack remediation costs.

Incentivized