Cisco Acquires Web Security Vendor ScanSafe

Cisco is augmenting its enterprise security offering by acquiring San Francisco and London-based ScanSafe to support its network security business for both on-premise and cloud-based applications.

Tom Gillis, vice president and general manager of Cisco's Security Technology Business Unit, said the acquisition will help Cisco realize its visions of a "borderless network security architecture that spans network and cloud-based services."

Combined with IronPort security, which it acquired in 2007, Cisco hopes to offer enterprise network administrators a single portfolio of tools that can protect the network from intrusion both through standard attacks against the firewall, as well as attacks that use Web-based applications as a vector, enforcing a single and "consistent set of policy enforcement capabilities."

Gillis also said Cisco's so-called "hybrid-hosted" delivery model will allow customers to "flexibly combine on-premise and cloud-based security services" that may reside either as an on-premise appliance, as a security module integrated into a switch or router, or as a cloud-based service.

Key to ScanSafe's Web security platform is a technology called Outbreak Intelligence, which scans all Web requests in real time using a combination of dynamic, reputation and behavior-based analysis engines. Here's a look at the process:

The application deconstructs every requested Web page into the core components (such as HTML, scripts, Flash etc), and then analyzes the individual content components using a highly parallel scanning process designed to maximize security while minimizing latency. Outbreak Intelligence also scans and monitors content and communications leaving the network to ensure that malware that might exist on the network cannot successfully communicate, preventing malicious commands from reaching the malware as well as stopping confidential data from leaving the network.

The company claims that this highly paralleled analysis blocks more than 20 percent more malware than signature-based applications, and, in particular, successfully blocks zero-day attacks that are designed to evade traditional security solutions.

ScanSafe's service will be integrated with the Cisco AnyConnect VPN Client, the newest virtual private network (VPN) product from Cisco, providing security for mobile devices as well.