Network Associates makes security buy

Network Associates announced Friday that it will buy Entercept Security Technologies, its second intrusion-detection acquisition in the past four days.

The security company will pay $120 million cash for Entercept, bolstering its recently announced acquisition of IntruVert Networks. The two companies protect customers from electronic intruders--Entercept by detecting attacks on servers, and IntruVert by detecting odd behavior on the network.

"It is a very logical extension of what we offer to enterprise customers," said Art Matin, president of Network Associates' McAfee Security division. "What Entercept has that goes beyond traditional antivirus solutions is signature-based detection for known attacks and anomaly detection for new attacks."

Although the two deals will move Network Associates into a new market, more importantly, it will diversify the company beyond its one-trick pony status with content filtering and bring it closer to competing head-to-head with Symantec's broader security product portfolio, said Matt Barzowskas, an analyst with First Albany.

"Network Associates used to have an intrusion detection product two years ago, but sold it off to focus on antivirus," he said.

But corporate America is increasing looking for a complete IT package, a trend that is also being applied to the security market. Analysts note it is especially true these days, as more and more companies create chief security officer positions. These captains of the network guards are looking for ways to reduce the number of IT companies they deal with, while at the same time improving interoperability with their security technology.

"Symantec is trying to provide a full product portfolio in the security space, and Network Associates is trying to go head-to-head with them," Barzowskas said, adding that Syamantec already has a head start in the intrusion space.

Other analysts agreed that intrusion detection is one of the important areas in security, and Network Associates did not have a presence in that area until its IntruVert acquisition.

"All last year (Network Associates) was shedding its security capability," said Peter Lindstrom, research director with consultancy Spire Security. "Now with these two acquisitions, they are looking to own the intrusion-detection space."

Symantec isn't the only competitor, Lindstrom said. Cisco Systems bought network-based intrusion detection company Okena in January for $153 million. Internet Security Systems has also focused on the intrusion-detection market.

However, some analysts believe that the price tag of such acquisitions isn't justified. In a recent Merrill Lynch report gauging the cost-effectiveness of Network Associates' purchase of IntruVert, the firm voiced its worries: "Given the challenges Symantec has faced since paying a hefty $135 million for Recourse, we are concerned that valuations for security related (acquisitions) reflect overly optimistic growth expectations."

Entercept provides host-based intrusion detection, which blocks attacks aimed at specific servers before damage can occur. The host-based technology uses a combination of behavioral rules and signatures to prevent both known and unknown attacks, rather than detecting and reporting them after they occur. IntruVert detects attacks by watching the traffic that is passed back and forth over a network, and determines which data is indicative of malicious activity.

Although Network Associates is gaining a foothold in intrusion protection, it's not forgetting its core business of content filtering, where it dominates the antivirus arena with its McAfee software. Last January, Network Associates announced plans to acquire Deersoft, an antispam filtering software company. That provided a second leg to its content filtering products.

But the company may further bolster its content filtering portfolio by making acquisitions of Web filtering companies, analysts said.

"They may expand their antivirus space with Web filtering acquisitions," Barzowskas said. "Basically, its software that monitors what Web site employees are going to and getting access to. It's the next area Network Associates may want to do something in."

The company, when it announced the Deersoft deal, had said it planned to make more acquisitions in the content filtering sector.

Network Associates also bought Traxess, a maker of real-time network data recording technology, last August.