Cisco's Security Salvo

12:20 PM -- Cisco's $850 million acquisition of IronPort has more than sticker-shock value. It is the latest in a series of moves toward consolidation of email management and security among the market's most powerful players. (See Cisco Buys IronPort .)

The purchase of 400-person San Bruno, Calif.-based IronPort pits Cisco against Microsoft, Symantec, and Secure Computing, in addition to a range of smaller players. The point is to gain traction in a market that's exploding, as IT pros scramble for ways to ensure a burgeoning volume of email is protected from within and without. (See Stop That Email!, Content Filtering Options Proliferate, and Email Looms as IT Threat.)

IronPort's appliances, positioned at the edge of the network just inside the firewall, catch spam and viruses before they attack in corporate email. The crown jewels include a database that examines email along some 150 parameters in order to build profiles of the servers sending email.

The IronPort appliance looks at country of origin, the amount of time the sending server has been online, the number of times it has contacted the organization previously, and so forth. From this it works up a number from -10 to +10, indicating how much a sender's messages appear to be like spam or malware.

IronPort claims that this "reputation database" catches 80 percent of spam before it hits the corporate network. The rest is stopped with additional software, including spam control from Sophos. The vendor also offers encryption and, via an alliance with Vontu, optional control of internally generated mail with problematic content.It all adds up to a do-all security solution for corporate email -- an approach that's gaining popularity by the month. The need to combine different functions was the impetus behind the purchase of PortAuthority by Websense last month. (See Websense to Buy PortAuthority.) It was also the reason Microsoft bought FrontBridge in 2005. (See Microsoft Pulls In FrontBridge.) And last year, Symantec shifted investment from its hardware business to bolster its security software efforts. (See Symantec Streamlines Security Biz.)

There is other competition too. Secure Computing offers its own "reputation database," and it has partnered with a range of players, including F5. (See F5, Secure Computing Team.) Content filtering providers such as Orchestria, Patron Systems, Reconnex, and Proofpoint see partnerships as a way of life.

Can Cisco, mighty as it is, confront this legion successfully? After all, big acquisitions have a tendancy to cause indigestion. (Just ask EMC.) And isn't Cisco a bit outside its network-centric comfort zone?

In its favor, Cisco has opted to postpone integration difficulties by making IronPort a separate business unit, retaining its management, including CEO Scott Weiss, its physical location, and mostly all of its employees.

So now the pressure is on seven-year-old IronPort. With 3,000 customers claimed, including Dell, Jetblue Airways, and Johns Hopkins University, the company appears to be up to the challenge. But so, it seems, are its competitors.IronPort says it's faster than other appliances, including Secure Computing's, and packs more functions into a single box. But those are subjective claims, and IronPort relies on partners for several key features -- partners with wills and partners of their own.

Over the next year, IronPort promises to deliver more end-user control, additional reporting capabilities, better URL filtering, and spyware control. But no one's standing still. Cisco's position in email security and management will depend on IronPort's ability to deliver the goods in a fierce race against formidable rivals.

Mary Jander, Site Editor, Byte and Switch