Network Associates to buy Entercept for $120M

IDG News Service - Network security software company Network Associates Inc. may be on a buying spree, having announced today that it will acquire privately held Entercept Security Technologies Inc. for $120 million in cash. Network Associates expects to complete the acquisition within 45 days.
Entercept makes intrusion-prevention technology that runs on network servers or hosts such as application and Web servers. The company's products combine protection using "signatures," or attack patterns that have already been identified, with behavioral rules.
For example, Entercept's products can restrict a Web server to normal activities such as serving Web pages. Attempts to perform other actions on the server, such as accessing a non-Web-related system resource or files, would automatically be blocked.
Such technology is often dubbed "intrusion prevention" because networks that deploy it can, in theory, simultaneously detect and thwart attacks for which no signature has been developed.
The purchase of Entercept is Network Associates' second in a week and reflects growing demand for intrusion-prevention systems to deal with new worms and viruses like Slammer that easily circumvent traditional antivirus and intrusion-detection software.
On April 1, Network Associates announced that it's buying Intruvert Networks Inc., a maker of network-based intrusion-prevention technology, for $100 million.
Like Entercept's technology, Intruvert's hardware-based network appliances combine signature detection with other strategies, such as anomaly detection, to block network attacks. Unlike Entercept's technology, however, Intruvert's IntruShield products inspect all incoming traffic at rates as fast as 2Gbit/sec. for attacks hidden in data packets.
The combination of host- and network-based intrusion-prevention packages with the McAfee antivirus and Sniffer network traffic analysis product lines will allow Network Associates to extend its reach to more areas of the corporate network, said the company.
The Entercept technology fits nicely within Network Associates' McAfee product line, expanding the protections for resources inside the firewall, according to Art Matin, president of McAfee security at Network Associates. "We see synergies between Entercept's server-based protection and McAfee's multitiered antivirus protections for all forms of servers," he said.
McAfee's antivirus products include ePolicy Orchestrator. Network Associates also acquired content-filtering and antispam technology when it purchased Deersoft Inc. in January, Matin said (see story).
In addition, Entercept researchers will join the McAfee AVERT team, adding their expertise on intrusion detection and prevention, Matin said.
He said Network Associates was attracted to the new acquisition by Entercept's more than 1,100 customers and 20,000 server deployments. Network Associates was also convinced that it should buy Entercept rather than any of its competitors because of glowing reports from customers on the performance of the Entercepttechnology, Matin said.
"From a partnering standpoint, we believe this [intrusion-prevention] technology is so fundamental to solutions in the market that we needed to own the technology," he said.
No decisions have been made yet on how the acquired technology will be branded and sold. Those decisions will come once the acquisition is completed within the next three to six weeks, Matin said.
Entercept is based in San Jose, not far from Network Associates' Santa Clara headquarters, which makes Network Associates optimistic that it will retain most of Entercept's staffers and have a smooth integration. Although no layoffs are planned as a result of the purchase, some are possible because of "overlap," Matin said.