Based in Fort Lee, N.J., the privately held Whale makes secure sockets layer (SSL) VPN and application firewalls. Terms of the deal were not disclosed.
Whale's software is already integrated with Microsoft's Internet Security and Acceleration Server (ISA), which is software for firewall, caching and authentication. In the short term, Microsoft will continue to sell Whale's products. Over time, Whale's technology will be integrated into Microsoft's secure access platform, said Joel Sloss, senior product manager in Microsoft's Security and Access division.
What Whale brings to Microsoft is the ability to set granular policy on application traffic, said Robert Whiteley, a senior analyst at Forrester Research Inc. in Cambridge, Mass. It has application optimizers that have predefined policy for different applications.
"The blessing and curse of SSL VPNs is they are very policy rich," said Whiteley. "Mainstream companies don't have time to tinker, and Microsoft knows that buyer very well. They are good at making policy point and click."
Currently, Microsoft uses IPsec for security, but the market is shifting to SSL because it is easier to administer and has lower associated costs, he said.
Whale was first known for securing IBM's Lotus Notes, but the security company has since expanded its technology to include any application. Other vendors that make similar security gateways include Aventail Corp., F5 Networks Inc. and Neoteris Inc., which is now a part of Juniper Networks Inc.
"[Whale's] security software already ran ISA as part of its DNA, so it made a natural acquisition target for Microsoft," Whiteley said.