NGFW - Value for money?

[gsk]

Hi All,

 

Could someone sell me on the value for money proposition for a NGFW as against something like pfSense for a school who have 0 services hosted on site that need to be externally accessed? Cloud PBX, Cloud file storage, on-prem AD.

 

Thanks,

[mavhc]

Nope, stick to pfsense

[localzuk]

It depends what you want from it. Terms like NGFW are not really useful unless you are looking specific capabilities you may want or need.

 

Do you want application level control and awareness? Deep packet inspection? IPS? Reputation and identity based threat detection?

[gsk]

It depends what you want from it. Terms like NGFW are not really useful unless you are looking specific capabilities you may want or need.

 

Do you want application level control and awareness? Deep packet inspection? IPS? Reputation and identity based threat detection?

 

I want to prioritise high-impact protections that are relevant for the circumstances of the environment. Is application awareness needed if the filtering product is blocking applications? Will IPS be useful with no on-site services to penetrate?

 

Geo-blocking is high on my list. No incoming ports are being opened/forwarded. Devices have endpoint protection and software firewalls. Updates are applied regularly.

 

I'm just trying to get some sense of tangible or specific scenarios where the things you describe become good value.

 

For example. 2FA - theres a clear case and scenario for it. If your credentials are leaked or guessed, the bad actor still can't access your account. Easy sell.

 

2nd Example. Geoblocking - we very rarely have a need to access sites based outside of the EU/US. Blocking access to others can/would prevent a good number (but not all) command and control calls from malware.