Network security software company Network Associates has continued its Intrusion Prevention buying spree, and announced that it would acquire privately held Entercept Security Technologies for US$120 million in cash.
Network Associates expected to complete the acquisition of Entercept within 45 days, it said.
Entercept makes intrusion protection technology that runs on network servers or "hosts" such as application and Web servers. The company's products combine protection using "signatures," or specific attack patterns that have already been identified, with behavioural rules.
For example, Entercept's products can restrict a Web server to normal activities such as serving Web pages. Attempts to perform other actions on the server, such as accessing a non-Web-related system resource or files, would automatically be blocked.
Such technology is often dubbed "intrusion prevention" because networks that deploy it can, in theory, simultaneously detect and thwart attacks for which no signature has been developed.
The purchase of Entercept is the Network Associates' second in a week and highlights the growing demand for intrusion prevention systems (IPS) given the disruption caused by new worms and viruses such as Slammer, which easily circumvented traditional antivirus and intrusion detection software (IDS).
Earlier last week, Network Associates announced it was buying IntruVert Networks, a maker of network-based intrusion protection technology.
Like Entercept's technology, IntruVert's hardware-based network appliances combine signature detection with other strategies, such as anomaly detection to block network attacks.
Unlike Entercept's technology, however, IntruVert's IntruShield products work "inline", inspecting all incoming traffic, at rates as fast as 2G bps, for attacks hidden in data packets.
The combination of both host- and network-based intrusion protection packages with Network Associates McAfee antivirus and Sniffer network traffic analysis product lines will allow the company to extend its reach to more areas of the corporate network, offering IPS protection both at the network perimeter and on interior host systems.
The Entercept technology would fit nicely within Network Associates' McAfee product line, expanding the protections for resources inside the firewall, president of McAfee security at Network Associates, Art Matin, said. "We see synergies between Entercept's server-based protection and McAfee's multi-tiered antivirus protections for all forms of servers," he said.
Entercept's products would join McAfee's antivirus products, including it's ePolicy Orchestrator as well as content filtering and anti-spam technology acquired with Network Associates' purchase of Deersoft in January, Martin said.
In addition, Entercept researchers would join the McAfee AVERT team, adding their expertise on intrusion detection and prevention, Martin said.
Entercept's customer base, with more than 1100 customers and 20,000 server deployments, as well as glowing reports from customers on the performance of the Entercept technology convinced Network Associates to acquire Entercept over other competitors, Martin said.
The purchases signal a determination by Network Associates to bring technology in house and go it alone.
The acquisition of IntruVert sealed the lid on a nascent partnership with Internet Security Systems (ISS) to add ISS's intrusion detection technology to the Sniffer line.
"From a partnering standpoint, we believe this (IPS) technology is so fundamental to solutions in the market that we needed to own the technology," Martin said.
No decisions had been made yet on how the acquired technology would be branded and sold, Martin said.
Those decisions would be made once the acquisition was complete within the next three to six weeks, he said.
The close geographic proximity of San Jose, California-based Entercept and Network Associates headquarters in Santa Clara made Network Associates optimistic that it would retain most of the Entercept staff and had a smooth integration, Martin said.
While no layoffs were planned as a result of the purchase, some were possible due to "overlap", he said.