CUPERTINO, CALIF. - Last week's buying binge by Symantec netted the company three more security firms - Recourse Technologies, Riptech and SecurityFocus - that will provide critical core technologies and hundreds of new customers.
The deals also might bring confusion for existing customers as Symantec goes about integrating the acquisitions into its product lineup.
Advertisement: |
Symantec is buying Recourse for $135 million to gain its ManHunt intrusion-detection system (IDS). About 150 customers, including Ingram-Micro and the U.S. Department of Energy, use ManHunt to spot network-based attacks. ManHunt primarily uses what is called anomaly detection - flagging unusual or suspicious events - rather than IDS signatures that have to be constantly updated. Symantec intends to phase out its own network-based IDS, NetProwler, which has failed to win market share or perform well in IDS tests, such as those The NSS Group conducted last December in England.
NetProwler has been the "one disappointment" in Symantec's product line, Symantec CEO John Thompson said last week as the company reported record quarterly earnings of $316 million, up 39% from the same quarter a year ago.
"ManHunt is not just stronger than what we had, but [also than] what our competitors had" in network-based IDS, Thompson said. The company continues to have confidence in its host-based IDS called Intruder Alert, he said.
In phasing out NetProwler in favor of ManHunt, Symantec is redrawing its product road map in a way that customers might find confusing.
Last May, Symantec shipped Gateway Security, an appliance that combines firewall/VPN, antivirus detection and IDS in one box. Symantec says it hasn't decided whether to drop the NetProwler technology from Gateway Security and substitute ManHunt. However, Symantec will drop plans for a NetProwler IDS appliance, executive vice president Gail Hamilton says.
"We'll be replacing and upgrading NetProwler pretty soon, migrating customers to ManHunt," Hamilton says.
Symantec also will alter plans for host-based Intruder Alert 4.0 that had called for merging some NetProwler network-based detection into the product later this year. Instead, there will be an effort to combine ManHunt and Intruder Alert in some fashion.
"These acquisitions by Symantec plug some very strategic gaps for them," says Pete Lindstrom, an analyst with Hurwitz Group. "They were being challenged in the R&D department."
Symantec is paying $145 million for managed security services provider Riptech to gain its Calterian monitoring system, which can collect input from firewalls and IDSes made by different vendors. Riptech has 500 customers.
Symantec will use Riptech's security monitoring system in its San Antonio security operations center and new centers it is opening in England and Germany.
The purchase of SecurityFocus for $75 million brings Symantec a service bureau providing security alerts on new threats and analysis that's expected to augment Symantec's efforts, which are mainly centered on antivirus response. SecurityFocus also runs the popular BugTraq mailing list.
The three deals come on the heels of another important acquisition by Symantec just a few weeks ago. Symantec purchased Mountain Wave for $20 million to gain its CyberWolf security management system. But that purchase also is causing detours on Symantec's product road map.
To meet commitments Mountain Wave made, Symantec this November will offer a second version of CyberWolf, but it will be sold only to customers who bought CyberWolf 1.0. At the same time, Symantec still intends to offer its previously planned security information management product, called Symantec Security Management System (SSMS) 1.0, in the fall.
"It doesn't have sophisticated real-time data correlation like CyberWolf, but SSMS does have the ability to normalize the security data from a number of security devices, including Check Point firewalls, Internet Security Systems RealSecure IDS and Network Associates antivirus products," Hamilton says.
Symantec plans to integrate the more powerful CyberWolf into SSMS next year.
RELATED LINKS
