Sophos to acquire Utimaco

On Monday, 28 July, Sophos, the security vendor, announced plans to acquire Utimaco, a German firm specialising in data loss prevention, with centrally managed encryption services handling both fixed systems and removable storage media. Sophos chief executive Steve Munford said that after carrying out a worldwide search, Sophos identified Utimaco as a top-tier player in endpoint protection. Other established players in the market include SafeBoot, recently acquired by McAfee, and Point Sec, now part of Check Point. Newer players are also getting into the endpoint protection market, with PGP last week extending its encryption expertise into an endpoint protection product.

The interest comes at a time when data loss via external attacks or the loss of a laptop or removable storage device has achieved added visibility due to high-profile incidents including HM Revenue & Customs' loss of tens of millions of confidential records.

Munford said the acquisition, if successful, would be a "natural extension" of Sophos' existing focus on protecting systems from external attacks and malware. Munford told Heise UK "The world has changed from the time when people hacked machines for fame and fortune. Now it's to steal data," – "With this acquisition we're not just protecting the systems and administering policies, but protecting the data at rest." Munford said the new openness of the network, due to mobile devices and removable storage, along with the importance of the information stored on various machines and the influence of sophisticated organised crime, have combined to make data loss a concern ranking with more traditional attacks, "The network has become more open than it has ever been before," – "Computers and devices go off site, partners log into the network remotely. Historically the network has been a castle with a moat, now the castle walls have come down."

Utimaco's SafeGuard product line includes systems for ensuring information is encrypted on core systems and also as it moves onto email and removable media. Munford said "SafeGuard is ensuring it's encrypted, and that the only person able to unencrypt it is the person it's intended for,". Sophos plans to retain the SafeGuard brand and to integrate the products into Sophos' own centralised management systems. Munford said "The overarching goal is that we're allowing you not to have eight different pieces of software at the endpoint from multiple vendors,". He said the integration process could take some time, pointing to a recent network access control acqusition whose technology took 18 months to integrate.

Among SafeGuard's specialties is key management for large numbers of devices. Munford said "If you imagine you've got 50,000 devices, and users are changing all the time, people are moving in and out of the company, managing the keys in a secure way is not a trivial problem," – "These guys do it particularly well." Munford said another plus is Utimaco's modular architecture, which allows the technology to be extended into other areas of information security. Utimaco has proven, mature technology and an already substantial footprint on end user systems, something Munford argued would not be easy to achieve for newer entries into the market, such as PGP Endpoint. Utimaco also makes software enabling mobile operators to provide data to law enforcement agencies for criminal prosecution.

Under German law UK-based Sophos is required to announce its acquisition plan before launching the voluntary public takeover offer, which will be tendered in August. The deal will need to be approved by Utimaco, based in Oberursel, near Frankfurt-am-Main, as well as the financial regulator, a process Sophos aims to complete by October. Sophos is proposing to buy 75 per cent of Utimaco's outstanding shares at €14.75 – £11.74 – per share for a total of €217 million. The company has made a separate arrangement to buy the remaining 25 per cent of shares from private equity company Investcorp Technology Partners.

(Matthew Broersma)

(trk)