Ncc Group Plc · LSE:NCC
Ncc — Investor Presentation (June 2006)
25 slides from Ncc's investor presentation, Jun 13, 2006
Slide 1: NCC Group plc Investor Forum
NCC Group plc Investor Forum 13 June 2006 1
Slide 2: Agenda
Agenda Background Escrow Solutions Product summary UK market German market US market development Verification Testing Penetration Testing Service summary The hacking landscape Web hacking demonstrations Personal information: the black market Summary 2
Slide 3: Background
Background What we do: provide IT assurance, security and consultancy services to over 11,000 clients worldwide - including 91 of the FTSE 100 USP: no ties or relationships to hardware or software suppliers enabling focus on developing intelligent solutions and building partnerships Size: base
Slide 4: Escrow Solutions: Product Summary
Escrow Solutions: Product Summary Deposit of Licensor Legal contract between three source code parties: Sale of business licensor (owner) critical licensee software independent third party Holds software source code / business critical material Provides protection from key supplier or ma
Slide 5: Escrow Solutions: UK market
Escrow Solutions: UK market 2003 2004 2005 2006 Market leaders – competition consists of smaller providers winning business on price - rare Existing customers are significant growth opportunity: Most businesses have insufficient protection Customers average just c.2.0 agreements, may need 19
Slide 6: Escrow Solutions: UK market
Escrow Solutions: UK market 2003 2004 2005 2006 New investment into direct marketing and educational campaign Continued investment in CRM database to improve client handling techniques Working on increasing effectiveness of account management Recruitment and retention a challenge - very comp
Slide 7: Escrow Solutions: German market
Escrow Solutions: German market Market research into German market suggests worth £88m - £102m IT infrastructure and new office in place Operational procedures now implemented Regional marketing plans now actioned Local PR/marketing agency appointed No plans to move into rest of Europe i
Slide 8: Escrow Solutions: German market
Escrow Solutions: German market Low level of competition - small, legal-focused providers Field sales the cultural norm but account management approach works UK account management model applied in Germany Eight person account management team selling Sales-focused operation supported by UK
Slide 9: Escrow Solutions: US market development
Escrow Solutions: US market development Acquisition in January 2006 has provided a renewals base of over $1.1m Market more mature but much larger than UK Owner led Less complex law No basic testing No verification testing Acquired operational team of 4 Reviewed selling techniques int
Slide 10: Escrow Solutions: US market development
Escrow Solutions: US market development Market more mature and better compliance Account management accepted for B2B UK style account management model being set up Opportunities in UK verification testing Relocated and invested in infrastructure West Coast marketing plan being developed
Slide 11: Escrow Solutions: Verification Testing
Escrow Solutions: Verification Testing Full verification involves auditing, documenting and full build with the software owner and licensee 8% of escrow deposits fail basic integrity testing Verification testing always results in an enhanced standard of deposit – provides genuine value to cust
Slide 12: Penetration Testing: Service summary
Penetration Testing: Service summary A leading UK provider of Penetration Testing services Ethically hack networks and Web sites Expert CHECK accredited team leaders - only c.80 in the UK Social engineering and forensic testing are an increasing share of revenues as customers more aware of t
Slide 13: Penetration Testing: PCI data security standard
Penetration Testing: PCI data security standard Summary of industry-wide standard (implemented June 2006): Merchant Criteria Assessment Network How NCC Group Level Security services fit in Scan 1 All merchants, including electronic An annual Quarterly commerce merchants, with independent more than 6
Slide 14: Penetration Testing: The hacking landscape
Penetration Testing: The hacking landscape Types of hacker Recent media coverage The Script Kiddie – motivated by kudos, notoriety and antisocial behaviour “Se cur ove ity a The Black Hat – motivated by the r In lert The te r n technical challenge, financial gain, Tim et c alls hacker for hire e
Slide 15: Penetration Testing: Market drivers
Penetration Testing: Market drivers Huge growth in VPNs and mobile/teleworker testing including Laptops/Blackberrys and PDAs New/updated Web applications are still a major driver PCI Data Security Standard emerging as major driver for both new customers having for first time test and existing
Slide 16: Penetration Testing: Hacking Demo
Penetration Testing: Hacking Demo Rules of engagement: All demonstrations are recreated from real attacks The demonstrations are in compliance with the Computer Misuse Act 1990 and all target systems belong to NCC Group All equipment is fully patched with the latest security updates All syst
Slide 17: Penetration Testing: Hacking Demo
Penetration Testing: Hacking Demo Demo #1: ‘Safe’ network attack Organisation conducts The hacker utilises scripting regular tools-based skills to access the network scanning to ensure its or system, in frighteningly network and systems quick time, gaining control (including Web sites) are of the ne
Slide 18: Penetration Testing: Hacking Demo
Penetration Testing: Hacking Demo Demo #2: Online retailing site attack Using a technique The hacker uses the called ‘SQL injection’ standard Web site the hacker 'fools' the search facility to query application into running the database which his query instead of the holds product details one progra
Slide 19: Penetration Testing: Demo #3 Password cracking
Penetration Testing Demo #3: Password cracking Cracking a password – key facts Hacker is connected to corporate Modern sophisticated hackers rarely have to network via the SQL server resort to ‘brute force’ attacks on passwords They have pre-computed tables where the work has already been done.
Slide 20: Personal information: the black market
Personal information: the black market What happens to hacked data? Popular trading sites: Criminal gangs buy and sell talkcash.net personal details freely on the Internet, starting from only a few cardersmarket.com hundred dollars darkmarket.ws/ You can buy a whole identity or sets of dat
Slide 21: Personal information: the black market
Personal information: the black market Trading credit card details: The screen shot shows the trading of “virgin” UK cvv2 at $2 each 21
Slide 22: Personal information: the black market
Personal information: the black market Skimming Productised face plate identity theft: suitable for The use with the professional ATM below: package available for $5000 per unit, with some bulk orders available at $100,000. 22
Slide 23: Personal information: the black market
Personal information: the black market Volume discounts are available: Stolen card dump information used to make cloned cards available at $15 each. With the right equipment a criminal can have cloned stolen credit cards available to them for a little under $60. 23
Slide 24: Personal information: the black market
Personal information: the black market Take out the competition: ‘Denial of Service’ attacks distributed to order. Services charged at between 30$ to 50$ 24
Slide 25: Summary
Summary Growth prospects are good for the markets in which the Group operates Increasingly stringent corporate governance regulations continue to present enhanced opportunities Focus on acquisitions and expansion into overseas territories will allow the Group to benefit from worldwide trends a