Decru on Symantec's wish list?

commentary When security giant Symantec bought storage specialist Veritas two years ago, the US$13.5 billion deal was a massive beacon pointing to technological convergence.

It was clear storage and security would become increasingly interwined in future. And Symantec signalled it had plenty more money to make that vision a reality.

"We expect to keep making six to eight acquisitions per year, with perhaps a larger deal, such as Veritas, every 18 months," Symantec's senior vice president of security products Enrique Salem said in November 2005.

Salem himself came to Symantec through an acquisition -- he is the former chief executive of Brightmail.

With the Veritas buy nailed down, industry speculation has now turned to which major player Symantec should buy next.

One attractive target -- encryption specialist Decru -- was instead snatched up by NetApp last year for just US$272 million. The Decru purchase provided NetApp with a sought-after real-time data encryption system.

The development of that system dates back to 2001, when Decru started realising its vision of a device that would encrypt data before it was put to rest on a tape backup library or other archive.

Following a spate of lost back up tapes and CDs in the past 12 months that have compromised the identities and personal details of millions of people -- for example, McAfee lost details of its employees because of a misplaced CD -- Decru's encryption device is now highly sought after.

One of Decru's advantages is that the deployment of its encryption devices does not require admins to change corporate applications or the target storage systems, according to Michael Warrilow, director of Sydney-based analyst firm Hydrasight.

Administrators can simply add the Decru box in front of their tape back-up systems or servers. "It masks the complexity of adding security for data at rest... it sits in the path of the data and encrypts it on the fly," Warrilow said.

In addition, even though Decru is now part of NetApp, the company is run independently and allowed to partner with NetApp's direct competitors such as EMC, and since its acquisition of Veritas, Symantec.

"We have a storage encryption processor, which is based on a field programmable gate array (FPGA)," Decru's business development manager Steve Bracken recently told ZDNet Australia.

"The chipset is able to do wire-speed encryption on several protocols -- fibre channel for encrypting disks in a SAN fabric, encrypting data as it traverses connection to a tape library (so we can encrypt fibre channel tape) and more recently, we implemented a SCSI version of the product," Bracken said.

He explained that Decru's technology is also used by its parent company's direct competitors, none of which have products that can compare in terms of performance or otherwise with Decru's box solution.

"With both Symantec and EMC there are co-opetition relationships in place. Decru does a significant amount of business with EMC... although RSA has encryption code, they don't have a product similar to the one we ship today," Bracken said.

"Symantec has the ability to turn on encryption in their backup application so we occasionally see that as a competitive threat... but the reality is that there are significant issues with degraded performance on the backup servers."

"We don't require changes to the target storage devices or the applications. It's about being able to do things without any performance overhead and it is transparent," added Bracken.

All of this makes for a very attractive offering for Symantec. The only caveat is that to get Decru, the security giant will now have to splash out on a big purchase of NetApp.

However, a combined NetApp/Decru buy could fill some big holes in Symantec's product range -- especially if the vendor is serious about re-inventing itself as an enterprise storage and security player.

It has been around two years since Symantec merged with Veritas and another mega-merger is probably on the cards. So even with a market cap of around US$14 billion, don't be too surprised if NetApp and Decru's future products are shipped in yellow boxes.