NetApp acquires Decru for security

By Ann Silverthorn

—Citing customer demand for data security, Network Appliance recently announced that it will buy Decru, a privately owned storage security company, for $272 million in cash and stock. The deal is expected to close in October. Decru's DataFort appliance encrypts data both at the perimeter and within a storage network, and it works in NAS, SAN (Fibre Channel or iSCSI), virtual tape library (VTL), and tape environments.

Decru will operate as an independent unit.

Decru currently has partnerships with EMC, Hitachi, IBM, and StorageTek, and Network Appliance plans to continue those relationships. Still, following Sun's acquisition of StorageTek, analysts are skeptical that such relationships with competitors will survive.

Rhoda Phillips, storage software research manager at International Data Corp. (IDC), says it will be a challenge for Network Appliance to keep Decru independent. "The challenge will be how to present a clear picture to clients about what the message is and not have the companies' two sales teams colliding with each other," says Phillips.

Phillips sees NetApp's acquisition of Decru as a strategic effort to expand its presence in data management and data protection rather than a tactical move, as when it recently acquired Alacritus. "This helps round that out rather than being a point solution."

Suresh Vasudevan, Network Appliance's senior vice president of product management, says, "Our perspective is that the data security problem is truly irrespective of whether the data is stored on an EMC or NetApp system. We don't want to just solve a NetApp data security problem. Decru's appliances work transparently, no matter whose storage is deployed."

Data security breaches can take the form of an attack or can be accidental. Either way, the security breaches and backup tapes lost in transit that have been much publicized recently are probably only the tip of the iceberg. And the fallout from the stolen information has yet to be felt.

"Most of our customers have invested in anti-virus solutions, spam filters, VPNs, and firewalls for perimeter security," says NetApp's Vasudevan." Those investments only protect from attacks from outside the corporation, but more than 50% of attacks originate from within the firewall."

Decru's encryption is designed to protect against attacks from both outside and within the firewall.

When asked why Network Appliance chose Decru, Vasudevan said the company is ahead of the competition because it can encrypt data in a variety of storage environments. In addition, Decru's certifications from the government and from standards bodies made it attractive. "Common Criteria Certification and DoD 5015.2 [for electronic records] are certifications that take several quarters if not years to obtain. No other competitor has been able to obtain those," says Vasudevan.

"NetApp's announcement will put more pressure on other top tier storage suppliers like EMC and IBM to bring encryption into their product portfolio," says IDC's Phillips.

Storage suppliers will eventually be forced to make data more secure as public pressure increases. If they don't want to continue partnering with Decru, they'll be faced with developing their own product or finding their own data security company to buy.

At a glance:

Decru's DataFort encryption appliance

  • Unified access: NAS, SAN, iSCSI, tape
  • Secure file deletion
  • Transparency
  • Enterprise-wide key management
  • Certification: FIPS level 2, FIPS level 3, DoD, 5015.2

This article was originally published on June 20, 2005