Cisco To Acquire Sourcefire For $2.7 Billion

Orome1 writes "Cisco will acquire Sourcefire, a provider of intelligent cybersecurity solutions. Under the terms of the agreement, Cisco will pay $76 per share in cash in exchange for each share of Sourcefire and assume outstanding equity awards for an aggregate purchase price of approximately $2.7 billion, including retention-based incentives. The acquisition has been approved by the board of directors of each company. Once the transaction closes, Cisco will include Sourcefire into its guidance going forward. Prior to the close, Cisco and Sourcefire will continue to operate as separate companies."

Comments

Time to fork Snort

[sl4shd0rk]

Hope most of it is under GPL.

Re:"provider of intelligent cybersecurity solution

[afidel]

Snort is an IDS not an IPS, in the role of an IDS it is VERY good (probably the best out there), though with the sourcefire modules it can be a bit annoying because it's hard to tell what exactly might be a false positive (with the community modules you can tell exactly what the rules is doing so you can tell if it's tripping on legitimate traffic). It does take some care and feeding, luckily we outsource that job to a local group that does nothing but security monitoring and management so we didn't have to develop the expertise inhouse.

Re:"provider of intelligent cybersecurity solution

[Drakonblayde]

There are a number of security companies, including one of Dell's acquired business units, that sell security appliances that are basically snort boxes. So yes, Snort is pretty widely used and deployed and not just messed around with by open source enthusiasts.

Personally, given Cisco's (mis)management of acquired companies in the past, and the inability of their business units to actually work together, I just lost all interest in Snort, unless someone forks it and manages to keep it up to the snuff that Sourcefire has. In the meantime, I'll be giving Bro IDS a very strong look

Re:"provider of intelligent cybersecurity solution

[Notabadguy]

Yes...Snort is an IDS, not an IPS.

Log Snort through Ethereal, or another network protocol analyzer of your choice, and you've just created a free version of what all these companies want to sell you.

Re:I'm happy about one thing

[TTL0]

Plus they provide "Agile Security". Ever get the feeling that Cisco is buying buzzwords and not a working product ?

Re:"provider of intelligent cybersecurity solution

[Gerald]

You misspelled Wireshark.

What Sourcefire Currently Does

[billstewart]

Disclaimer: At $DAYJOB, I work on managed security services using Sourcefire, but this is my own personal commentary, not that of my employer.

Sourcefire's primary product line takes Snort, wraps it in hardware appliances, and adds a lot of management tools that you can use in an enterprise or managed services environment. This past year, they've added a firewall capability to compete with Palo Alto* and the UTM vendors like Fortinet - in addition to basic firewall support they've got application identification, so you can do things like allow users to read Facebook but block Facebook games, and you can also do things like URL censorship and known-bad-site blacklisting. They've also been buying up other companies like ClamAV and Immunet, so they've got feeds of malware site identification, and are starting to integrate that with the firewall/IDS as well as continuing the host-based versions.

Cisco's IDS/IPS offers have been pretty lame the past few years, but they've got decent firewalls, so we'll see how those product lines play against each other. (I don't know what Cisco's doing in Anti-virus and cloud malware detection these days.)

Sourcefire's hardware at the low end is basically Linux box appliances, and at the high end they're doing a bunch of hardware acceleration. Their largest single box will handle 10 Gbps of inspection, and they can cluster up to four of those to support 40 Gbps. There's not much competition up at the high end - McAfee may have come out with a 10 Gbps follower to their previous 5 Gbps box, and Juniper has some boxes that are bigger but are mainly firewalls with some limited IPS capability. If you've got existing Snort on Linux, Sourcefire does also sell connection tools to integrate with their management systems.

*The term "Next Generation Firewall" means "whatever Palo Alto's marketing says it means", but is at least firewall plus application identification. I've heard that Cisco tried to buy Palo Alto last year.