Network Appliance Inc. Thursday said it intends to buy start-up Decru Inc. for US$272 million, giving legitimacy to a small but fast-growing market of storage security products. The move comes on the heels of many high-profile data thefts and losses in the financial services industry and other businesses that have spurred IT shops to begin deploying technology to encrypt archived data, analysts said.

The move by Sunnyvale, Calif.-based NetApp trumps the industry in what will likely be a rush by other vendors to either buy or create their own storage security technology, said Jon Oltsik, an analyst at Enterprise Strategy Group Inc. in Milford, Mass.

"Other storage companies who really have paid little attention to storage security have to take note now," Oltsik said.

While storage security is about a $60 million market today, within two years, "you won"t be able to have a conversation with a client about storage without talking about security," Oltsik said.

Rich Mogull, an analyst at Gartner Inc. in Stamford, Conn., said enterprise-class companies nervous about landing on the front page of newspapers like others with recently publicized data losses have been driving the storage security market over the past six to nine months. The market will be spurred on further with the backing of a large vendor like NetApp.

"There"s really only two vendors for encrypting backup tapes and that"s Decru and NeoScale," he said.

NeoScale Systems Inc. is based in Milpitas, Calif. Other storage security vendors that play in the disk drive market include Kasten Chase Applied Research Ltd. in Mississauga, Ontario, and Vormetric Inc. in San Jose.

Since February, Bank of America Corp., Ameritrade Holding Corp., Time Warner Inc., ChoicePoint Inc. and Reed Elsevier Group PLC"s LexisNexis Group unit all reported the loss of unencrypted data that in several cases contained the personal information of millions of people. Time Warner followed its data loss by saying it will "quickly" begin encrypting all data saved to backup tapes. Ameritrade said it is considering encrypting its archived data.

Companies are also being pressured to encrypt data by federal privacy regulations like the Gramm-Leach-Bliley Act, which mandates security and privacy best practices for financial institutions, and state privacy laws, such as the California Database Breach Act, which requires companies to notify customers when data is lost.

"We just think there"s a great market opportunity. Decru ... is clearly the market leader," said NetApp CEO Dan Warmenhoven. "You look at the approach they"ve taken, and it"s incredibly aligned to our own. It"s an appliance-based model."

Warmenhoven said he would keep Redwood City, Calif.-based Decru independent and set it up more or less as "an internal OEM to the Network Appliance"s sales force and channels, as well as an independent relationship with our traditional competitors. We intend to operate Decru on the other side of a Chinese wall where there won"t be poaching of their opportunities by Network Appliance"s sales force."

Decru"s Data Fort network appliance protects data at rest on disk and tape, as well as data in transit, by using 256-bit AES ciphers to encrypt data as it"s being moved from an application server to a disk on a network-attached storage or storage-area network, or to a tape drive. The appliance also manages authentication and secure logging and access controls.

"If anything, this will actually help Decru because it reduces the concerns of working with a small vendor," Mogull said.