April 04, 2003, 3:11 PM — Network security software company Network Associates Inc. continued its Intrusion Prevention buying spree, saying on Friday that it would acquire privately held Entercept Security Technologies Inc. for US$120 million in cash.
Network Associates expects to complete the acquisition of Entercept within 45 days, it said.
Entercept makes intrusion protection technology that runs on network servers or "hosts" such as application and Web servers. The company's products combine protection using "signatures," or specific attack patterns that have already been identified, with behavioral rules.
For example, Entercept's products can restrict a Web server to normal activities such as serving Web pages. Attempts to perform other actions on the server, such as accessing a non-Web-related system resource or files, would automatically be blocked.
Such technology is often dubbed "intrusion prevention," because networks that deploy it can, in theory, simultaneously detect and thwart attacks for which no signature has been developed.
The purchase of Entercept is the Network Associates' second in a week and highlights the growing demand for intrusion prevention systems (IPS) given the disruption caused by new worms and viruses such as Slammer, which easily circumvented traditional antivirus and intrusion detection software (IDS).
On Tuesday, Network Associates announced it was buying IntruVert Networks Inc., a maker of network-based intrusion protection technology.
Like Entercept's technology, IntruVert's hardware-based network appliances combine signature detection with other strategies, such as anomaly detection to block network attacks.
Unlike Entercept's technology, however, IntruVert's IntruShield products work "inline," inspecting all incoming traffic, at rates as fast as 2G bps, for attacks hidden in data packets.
The combination of both host- and network-based intrusion protection packages with Network Associates McAfee antivirus and Sniffer network traffic analysis product lines will allow the Santa Clara, California, company to extend its reach to more areas of the corporate network, offering IPS protection both at the network perimeter and on interior host systems.
The Entercept technology will fit nicely within Network Associates' McAfee product line, expanding the protections for resources inside the firewall, according to Art Matin, president of McAfee security at Network Associates.
"We see synergies between Entercept's server-based protection and McAfee's multitiered antivirus protections for all forms of servers," he said.
Entercept's products will join McAfee's antivirus products, including it's ePolicy Orchestrator as well as content filtering and antispam technology acquired with Network Associates' purchase of Deersoft Inc. in January, Martin said.