Network security software company Network Associates Inc. continued its Intrusion Prevention buying spree, saying on Friday that it would acquire privately held Entercept Security Technologies Inc. for US$120 million in cash.
Network Associates expects to complete the acquisition of Entercept within 45 days, it said.
Entercept makes intrusion protection technology that runs on network servers or "hosts" such as application and Web servers. The company's products combine protection using "signatures," or specific attack patterns that have already been identified, with behavioral rules.
For example, Entercept's products can restrict a Web server to normal activities such as serving Web pages. Attempts to perform other actions on the server, such as accessing a non-Web-related system resource or files, would automatically be blocked.
Such technology is often dubbed "intrusion prevention," because networks that deploy it can, in theory, simultaneously detect and thwart attacks for which no signature has been developed.
The purchase of Entercept is the Network Associates' second in a week and highlights the growing demand for intrusion prevention systems (IPS) given the disruption caused by new worms and viruses such as Slammer, which easily circumvented traditional antivirus and intrusion detection software (IDS).
On Tuesday, Network Associates announced it was buying IntruVert Networks Inc., a maker of network-based intrusion protection technology.
Like Entercept's technology, IntruVert's hardware-based network appliances combine signature detection with other strategies, such as anomaly detection to block network attacks.
Unlike Entercept's technology, however, IntruVert's IntruShield products work "inline," inspecting all incoming traffic, at rates as fast as 2G bps, for attacks hidden in data packets.
The combination of both host- and network-based intrusion protection packages with Network Associates McAfee antivirus and Sniffer network traffic analysis product lines will allow the Santa Clara, California, company to extend its reach to more areas of the corporate network, offering IPS protection both at the network perimeter and on interior host systems.
The Entercept technology will fit nicely within Network Associates' McAfee product line, expanding the protections for resources inside the firewall, according to Art Matin, president of McAfee security at Network Associates.
"We see synergies between Entercept's server-based protection and McAfee's multitiered antivirus protections for all forms of servers," he said.
Entercept's products will join McAfee's antivirus products, including it's ePolicy Orchestrator as well as content filtering and antispam technology acquired with Network Associates' purchase of Deersoft Inc. in January, Martin said.
In addition, Entercept researchers will join the McAfee AVERT team, adding their expertise on intrusion detection and prevention, Martin said.
Entercept's customer base, with over 1,100 customers and 20,000 server deployments, as well as glowing reports from customers on the performance of the Entercept technology convinced Network Associates to acquire Entercept over other competitors, Martin said.
The purchases signal a determination by Network Associates to bring technology in house and go it alone.
The acquisition of IntruVert on Tuesday sealed the lid on a nascent partnership with Internet Security Systems Inc. (ISS) to add ISS's intrusion detection technology to the Sniffer line.
"From a partnering standpoint, we believe this (IPS) technology is so fundamental to solutions in the market that we needed to own the technology," Martin said.
No decisions have been made yet on how the acquired technology would be branded and sold, according to Martin.
Those decisions will be made once the acquisition is complete within the next three to six weeks, he said.
The close geographic proximity of San Jose, California, based Entercept and Network Associates headquarters in Santa Clara makes Network Associates optimistic that it will retain most of the Entercept staff and have a smooth integration, according to Martin.
While no layoffs are planned as a result of the purchase, some are possible due to "overlap," Martin said.