The two-phased integration deal will first see Cisco’s intrusion detection software, which can be loaded on the company’s flagship enterprise routers and switches, use Trend-developed worm signatures. This stage of the deal is expected to become reality in the third quarter.
The deal is not for the full set of Trend definitions, just network worms, which don’t exist as files, but are transmitted from memory to memory over the network. These number merely hundreds, but can be particularly damaging, as shown by the Slammer, Blaster and Code Red outbreaks.
Cisco director of product management Tom Russell said existing Cisco IPS customers will have these signatures downloaded to their hardware at no additional charge. Cisco has some signature-based and anomaly-based intrusion prevention features already.
In the fourth quarter, Cisco will also start selling a cut-down version of Trend’s Control Manager management console, branded as the Cisco Incident Control Center (ICC), from which three more pieces of anti-worm technology licensed from Trend will be offered.
Cisco will use Trend’s Outbreak Prevention Service, Trend’s stopgap worm blocking offering, in which customers are sent a policy that can spot and block newly released worms, while Trend’s virus researchers work on a signatures.
Through the ICC, Cisco will also offer Trend’s recently introduced vulnerability scanning service and its incident cleanup system, which deploys software to infected nodes to clean up worm damage and prevent further infections.
All these pieces of software are also offered by Trend, which in January launched its own worm blocker, the Network VirusWall, a $6,000 device that uses a combination of signatures and pattern recognition to spot worm outbreaks and block them.
There is some overlap between Trend’s own products and Cisco’s, according to Trend product group manager John Maddison. We’re focusing Network VirusWall on non-Cisco accounts, he said. We’ve done a lot of work to make sure there are no channel conflicts.
The deal expands on a relationship formed last November, when Trend was one of the three launch members of Cisco’s Network Admission Control program (NAC). NAC sees anti-virus software talk to Cisco’s access control policy software.
Symantec and Network Associates are also NAC members. Russell said the decision to license Trend’s technology was made because Trend has a lifecycle approach to fighting off worms, and because it is strong in the gateway anti-virus business.
Cisco has been boosting its security offerings lately, having identified security as one of several growth drivers. The strategy has gained added significance since rival Juniper Networks bought firewall player NetScreen Technologies and identified the deal as its route into Cisco’s core enterprise business.
