Decru Put a Lock Where the Data Lived

A backup tape is a remarkably small object on which to place a large promise. In 2005, Boeing Employees Credit Union was sending roughly 140 of them a week to an offsite archive. The data on those tapes passed through a Decru appliance before leaving the building. The courier might lose a box; the contents would still be unreadable without the keys. It was a wonderfully unromantic answer to a frightening question: what happens when a copy of your data walks out the door?

Decru was founded in 2001 by Dan Avida and Serge Plotkin. Its first products arrived in 2002, just as enterprises were collecting more information than their older security habits had been built to protect. Firewalls guarded the perimeter. Virtual private networks protected information moving across the internet. Yet a disk, a backup tape, or a storage administrator with broad access could expose the thing everyone was trying to save. Decru called this problem data at rest, a phrase that now sounds inevitable. At the time, it helped make a neglected risk easy to name.

The useful place for a lock

DataFort was a rack-mounted security appliance positioned between a server and its storage. A server sent data out as usual; DataFort encrypted it before it landed on disk or tape. On the way back, the appliance checked access and decrypted the data for an authorized requester. Depending on the model, it could work with Fibre Channel storage networks, Ethernet-based network-attached storage, or tape. Its software also handled authentication, logging, compartmentalized vaults called Cryptainers, and the awkward but vital business of managing encryption keys.

This was Decru's competitive move. An application-level encryption project can involve developers, operating systems, file servers, databases, and users. Decru offered a way to avoid much of that coordination. It sold hardware and supporting software to enterprises and government agencies that needed to protect sensitive files, backups, or regulated records. NeoScale and other vendors pursued similar storage security work; software encryption and features built into storage systems were alternatives. Decru's particular pitch was breadth across mixed equipment, plus a deployment that could leave everyday workflows largely alone.

A seven-terabyte test

The Center for the Evaluative Clinical Sciences at Dartmouth College made the idea concrete in 2004. Its researchers handled about seven terabytes of confidential Medicare data. The storage setup was a mixed household: Linux clients, Dell file servers, and NetApp network-attached storage. Rebuilding that environment for encryption would have been a project of its own. Dartmouth installed two clustered DataFort E510 appliances instead. The reported list price was $30,000 each, so the pair represented about $60,000 in hardware before any other costs.

“We didn't want to invest in a system that would cause us to alter our environment.”Vincent Fusca, Dartmouth CECS operations director

The installation took a couple of hours, according to the customer account. It was not quite plug and play. That small caveat matters. Decru's appliance reduced the number of moving parts an organization had to change, but it still had to fit the network, the storage protocols, and the people who ran them. The center gained encryption, access controls, and audit logging without asking researchers to learn a new way to work. DataFort also let administrators separate data into controlled groups - a useful way to make the compromise of one area less likely to expose every area.

At Boeing Employees Credit Union, the fear was less academic. Backups left the site every week. Its team used Decru's T-Series appliance to encrypt data written to tape, reportedly without adding latency to the backup process. Yet compatibility was imperfect: interactions with Hewlett-Packard disk arrays caused occasional reboots while certification work lagged. Daniel Chow, an engineer there, said his team spent substantial effort resolving the technical issues. That is the part of the story every buyer should keep. “Transparent” describes the end user's experience, not a guarantee that integration will be effortless.

The price of being in the middle

The company also had to prove that its box could be trusted with a remarkably privileged job. Decru's storage encryption processor received FIPS 140-2 Level 3 validation in 2004. The FC520 line was later evaluated under Common Criteria. Those are meaningful credentials for a product asked to control keys and access to critical storage. Even the case was designed to convey the assignment: industrial design firm Ziba gave DataFort a blue-and-black face, heavy grille, and curved display module in a four-week turnaround. Security had acquired a physical silhouette.

Money followed the problem. In July 2002, Decru announced more than $27 million in its second financing round, bringing total funding above $43 million. The investors included Benchmark Capital, Greylock, New Enterprise Associates, Canon, and In-Q-Tel, the venture group backed by the CIA. That roster hints at the market Decru saw: commercial storage in banks and hospitals, and sensitive information in government systems. By 2004, it reportedly had about $6 million in revenue. The hardware was costly, but the cost of exposed records was beginning to look larger.

NetApp had already partnered with Decru on joint customer solutions since early 2004. In June 2005 it announced an agreement to buy the company for about $272 million. The completed transaction in August came to approximately $260 million in cash and shares. The distinction is small enough to vanish in casual retellings and large enough to deserve accuracy. NetApp wanted protection that worked beyond its own arrays, across a customer's collection of storage vendors. Decru brought both a product and a reason for security-conscious customers to consider NetApp's broader offering.

The idea outlived the appliance

Acquisition was not the end of the technical argument. It changed who would carry it. NetApp later stopped offering the Fibre Channel DataFort line and steered customers toward Brocade encryption products, which licensed Decru technology. By 2012, a NetApp product leader described SafeNet's StorageSecure as a successor to DataFort. The original blue-and-black hardware was no longer the center of the story. The need to encrypt information in storage remained.

For a reader trying to copy Decru's move, the lesson is more precise than “build a security box.” Find the place where a control can cover many systems without making every user change behavior. Then test the troublesome edges: old data that must be migrated, arrays that have not been certified together, key recovery, and the failure of a device sitting in a critical path. Decru's first advantage was making a difficult security decision deployable. Its lasting lesson is that the best point of control is valuable precisely because so much depends on it.