EMC & RSA sitting in a tree...

You know how that old nursery rhyme ends, right? It seems that the rumor mill is pumping about the possibility of EMC acquiring RSA for about $1.8 billion. There also seems to be another bidder in the picture, which could drive the price even higher. RSA has confirmed the strategic discussions, but predictably hedged as to whether a deal was going to get done. The fact they acknowledged the discussions means something is close, very close.

TheStreet.com has a pretty comprehensive story on the potential deal here.

It's been no secret that I think RSA is once again in the right place at the right time (here and here). LIghtning usually doesn't strike twice, but given the renewed interest in authentication and some savvy acquisitions - RSA is a plum property. But why sell now?

There's an old adage about how no one ever went broke by selling too soon, and that's exactly right in RSA's case. Sure they are hot and sure things look pretty good, but security is notoriously fickle and to monetize today wouldn't be a bad thing. And Art Coviello could ride off into the sunset as a hero.

But why is EMC interested? Is Symantec's John Thompson right in that security and storage are inextricably linked now? Has NetApp's increased interest in security (they acquired Decru a while back) shown the shape of things to come? Actually the answer is yes and yes.

It gets back to the Pragmatic Security model. Securing the infrastructure and securing the information that rides on top of it are DIFFERENT things. It will not be the same vendor that dominates both, that is clear because they are different buyers. The network or desktop guys buy information security. The application or database guys buy information security. How many more ways can I say different?

Though RSA gets most of it's notoriety nowadays from authentication, remember what RSA stands for - and that's encryption. EMC is all about "information lifecycle management" and that MUST include data security. They dipped their toes in the water by acquiring Authentica a while back, but you had to figure there would be more where that came from. RSA would give them instant credibility in the security space, a hot authentication product family, and most importantly a really big story regarding persistent control of data that no other vendor can match.

That's right, not even Symantec will be able to play at the same level. Symantec's entire security perspective is focused on the infrastructure. They do pretty much nothing (with the exception of some messaging security) in the application/information or identity space. In one fell swoop, EMC would become the horse to beat on the information side of the Pragmatic Security equation. John Thompson would have another reason to bury his head in the sand.

So who would the other bidders be? Thestreet.com indicates potentially CA or even Symantec. CA is pretty much in shambles right now, so I'd be very surprised if they could get their act in gear to do a big deal, though strategically it makes sense. But clearly Symantec would be the dark horse. For every reason this deal makes sense for EMC, it makes even more sense for Symantec. It gives the Veritas group some encryption and identity mojo and provides the glue to make the Symantec/Veritas deal work. Additionally, the tokens would fit very nicely into Symantec's security business giving them another cash cow to milk for a while.

But could John Thompson pull that off? They did just raise a bunch of money in a convertible offering, so the cash is there. I'd have some operational concerns given that Symantec has a poor track record of retaining talent and that's critical to make a growth deal work, but the potential of a Symantec/RSA combination is very interesting.

Stay tuned. It should be an interesting couple of days.