Cyber-security: to catch a thief (Jan 22, 2009) Tara Hedlund, CFA, CPA Christopher McHugh Robert Turner, CFA Michael Lozano Daniel Hirsch You may think the doomsday scenarios of the banks and automakers that are seeking bailouts from the federal government are scary -- the prospect of hundreds of thousands of jobs lost, a chronic credit crunch, plant closings, and bankruptcies. But all of that is relatively tame compared with the Night of the Living Dead-caliber scenarios conjured up by authorities in the field of digital security, or "cyber-security." For one, there’s O. Sami Saydjari, chief executive officer of Cyber Defense Agency, a firm specializing in cyber-security research. In Mr. Saydjari’s vision of cyber apocalypse, a major attack by hackers on U.S. digital networks could result in the power, banking, and communications infrastructure crashing and Americans scrounging for food, water, gasoline, and firewood to subsist. The horror, the horror: disrupt the Pentagon’s digital systems, for instance, and you have the potential to negate much of America’s high-tech military prowess. Here’s how BusinessWeek sums up today’s cyber-security conundrum: "As the world’s corporations, governments, military forces, and computer users have gravitated to the Web, so have competitors, adversaries, criminals, and spies, including government-backed electronic operations establishing footholds for potential attacks." Hackers emboldened Indeed, as digital networks grow more complex and hackers grow more sophisticated, the incidence of security breaches and break-in attempts is rising. The Homeland Security Department reported it was subject to 12,986 cyber attacks in 2007 -- triple the number of two years earlier. And the Defense Department’s computers are probed hundreds of thousands of times daily by foreign hackers, many of them suspected to be members of the military services of China and Russia. Consider this small sample of how hackers are invading various digital systems with malevolent intent and increasing effectiveness: * The Defense Department has acknowledged that at some point in the past two years its digital networks were compromised by malicious software called "malware," which takes over a personal computer and then uses it to spread more malware to other machines at an exponential rate. Much of the Pentagon’s network of 7 million electronic devices worldwide was exposed to a particular kind of malware known as agent.btz. What’s worrisome is that the Pentagon is uncertain that the steps taken to erase agent.btz from all of its hardware have been entirely successful. * Hackers believed to be based in China reportedly gained access to classified data stored on the digital networks of Lockheed Martin, Sandia National Laboratories, and NASA in 2004. * A loosely organized hacking syndicate stole tens of millions of credit-card and debit-card numbers from nine major U.S. retailers in 2008, according to The New York Times. The criminals stored much of the data on computer servers in Latvia and Ukraine, then imprinted some of the stolen numbers on blank credit and debt cards for use at automated teller machines. Third wave breaking Cyber-hacking is undergoing the third wave in its evolution, in the view of the Stanford Group Company, an investment firm. In this third wave, foreign governments and highly organized, amply financed criminals are the primary bad guys, relentlessly devising ways to steal sensitive information from the military, the government, corporations, and consumers. The culprits in the first wave were amateur hackers, succeeded by a second wave of spammers and small-time criminals. In response to this third wave, the military, the government, corporations, and consumers are intensifying efforts to prevent nightmarish cyber scenarios from happening -- efforts that we think should translate into above-average long-term growth prospects for the cyber-security market. The federal government plans to spend more than $30 billion in the next seven years to enhance the security of its digital networks, the Stanford Group estimates. And corporate America may spend an equal amount on cyber-security during that time, according to conservative estimates by our industry contacts. McAfee, an industry leader, expects the cyber-security market to grow from $24 billion at present to $35 billion by 2010. The market is as fragmented as a big, unassembled jigsaw puzzle, containing more than 1,000 competitors. We think the market pieces should gradually be joined, and McAfee and another leading competitor, Symantec, will likely be among the most acquisition-minded in the consolidation process. Creating top-level posts The Obama administration is placing a high priority on cyber-security and should help drive the market’s growth, in our view. The administration is expected to appoint a cyber-security "czar" who reports to the President and assumes responsibilities previously delegated to the Homeland Security Department. The administration is also expected to name a chief technology officer, who will be responsible for establishing and overseeing federal information-technology and cyber-security policy. In light of the proliferation of hacker threats, it’s not at all surprising that the entire federal government is demonstrating a greater sense of urgency about cyber-security. A government and technology-industry panel sponsored by the Center for Strategic and International Studies has called cyber-security a national issue on a par with global terrorism. The U.S., one panel member says flatly, is "hemorrhaging" national secrets and proprietary and personal data. A sense of urgency is similarly evident in the private sector. Hackers are rummaging around corporate databases in search of confidential financial data, product designs, and engineering plans that can be sold to competitors and governments around the world. Our contacts predict that the most lucrative activity for hackers going forward is likely to be the theft of intellectual property from companies. Such thievery cost companies almost $40 billion in 2007, McAfee estimates. And a study by Palo Alto Networks, a cyber-security firm, found that 80% of corporate digital networks contained "unauthorized proxies," or software that disguises applications for spying and gaining corporate trade secrets. Gone phishing Consumers are also being targeted in cyber attacks, such as phishing (a play on words for fishing, in which e-mail users are baited to divulge personal or corporate information). Last spring, for example, thousands of executives nationwide received e-mails that seemed official subpoenas from the U.S. District Court in San Diego. The e-mails contained a link that supposedly led to a copy of the entire subpoena. But the estimated 2,000 executives who clicked on the link unwittingly downloaded and installed software that made it possible for hackers in Singapore to secretly record passwords and other personal and corporate information. Altogether, online fraud perpetrated on consumer big fish and little fish totaled $239 million in 2007, with an average loss of $2,530, according to the FBI and the nonprofit National White Collar Crime Center. In our analysis, a heightened emphasis and spending on cyber-security by the military, the government, business, and consumers may especially benefit these six companies over the next few years: Check Point Software Technologies, McAfee, SAIC, SRA International, Symantec, and Websense. All of them are either small or mid-capitalization companies. Check Point Software Technologies (market capitalization: about $4.5 billion) is the only major cyber-security company based overseas, in Tel Aviv. Its business is as well balanced geographically as any in the industry; of the company’s annual revenue of more than $730 million, 45% comes from the U.S.; 44% from Europe, the Middle East, and Africa; and 11% from Asia. According to Gartner, a technology-research firm, Check Point holds the top market share in "enterprise firewalls," designed to prevent unauthorized access to corporate Web sites. The company is currently wrapping up the acquisition of Nokia’s security-appliance business, which we think will fortify its already strong lineup of security products and services. McAfee is debt-free Based in Santa Clara, California, McAfee (market capitalization: about $4.9 billion) derives about 30% of its annual revenue of more than $1.3 billion from work for the federal government. Its security software is used at more than 60 million sites and is continually put to the test: in 2008 it identified more than 360,000 cyber threats. Like a number of leading tech companies, McAfee is debt free, and its balance sheet contains more than $1 billion in cash, cash equivalents, and investments. The company’s net income rose 148% from 2003 to 2007. SAIC (market capitalization: about $8 billion) has been on a roll over the past 12 months: the company has won 17 cyber-security contracts valued at $8 billion. Headquartered in San Diego, SAIC has assembled a management team that’s highly regarded in the industry, and its stock has traded at a premium since first offered publicly in 2006. Wall Street analysts say the company has a timely opportunity to expand its operating margins, now that the start-up costs on most of its cyber-security projects have already been paid. The company’s annual revenue totals more than $9 billion. SRA International (market capitalization: about $990 million) serves national-security, government, and health-care customers. Headquartered in Fairfax, Virginia, the company has been profitable every year since its inception in 1978, with earnings growth of more than 15% annually. SRA’s annual revenue of $1.5 billion in 2008 was bolstered by the acquisition of two companies, Era Systems and Interface & Control Systems, the developers of technically advanced cyber-security technologies for defense markets. The company’s revenue has grown by factor of four since 2002. Symantec (market capitalization: about $12 billion) has grown both from steadily rising sales ($5.9 billion in 2008) and acquisitions (13 of them since 2005). Based in Cupertino, California, Symantec has a financial objective of improving its operating margins by one percentage point annually (which hasn’t always been achieved) and does business with 99% of the Fortune 1000 companies. Its Norton line of products is the performance standard for personal-computer security. A new product for PCs, Norton Internet Security 2009, was characterized by Walter S. Mossberg, a Wall Street Journal technology columnist, as "the fastest, simplest, and least obtrusive security suite I have ever used." Websense (market capitalization: about $700 million) has developed software that helps protect 50,000 organizations of all types and sizes from cyber attacks. The company’s products have repeatedly earned accolades in the marketplace. Frost & Sullivan, a consulting firm, believes that "Websense will be the ‘go-to’ computer-security company for corporations which are seeking solutions to protect both their networks and their data." Headquartered in San Diego, the company has at least a 25% share of the market for Web-security software, according to IDC, a technology-data firm. Websense obtains more than 40% of its annual revenue of about $210 million overseas.
The views expressed represent the opinions of Turner Investment Partners as of the date indicated and may change. They are not intended as a forecast, a guarantee of future results, investment recommendations, or an offer to buy or sell any securities. Opinions about individual securities mentioned may change, and there can be no guarantee that Turner will select and hold any particular security for its client portfolios. Earnings growth may not result in an increase in share price. Past performance is no guarantee of future results. Turner Investment Partners, founded in 1990 and based in Berwyn, Pennsylvania, is an investment firm that manages more than $15 billion in stocks in separately managed accounts and mutual funds for institutions and individuals, as of December 31, 2008. As of December 31, 2008, Turner held in client accounts 2.7 million shares of McAfee, 373,962 shares of SAIC, 620 shares of Symantec, and 1.2 million shares of Websense. Turner held no shares of Check Point Software Technologies and SRA International.
|
| Send This Page To A Friend |
| Subscribe to Commentary |
Sector Focus
Sector Focus Library
Consumer
Harley, Honda, and Sony: the leaner, meaner machinesThere's life yet in an aging auto industry
Education firms make the grade in a recession
Cyclical
U.S. steel industry: an early economic barometerLNG: the ups trump the downs
Recycling: good for the ecosystem and profits
Financial Services
To us, the best regional banks are the best-capitalized regional banksYes, investment banking is still alive and well
Seven you can still bank on
Health Care
Acquisitions: Big Pharma's response to expiring patientsThe drugs may be generic, but their prospects aren't
How defensive is health care?
Technology & Telecom
Light-emitting diodes: The Great Light HopeWhy small solid-state drives may become big
Cyber-security: to catch a thief
FOR INSTITUTIONAL USE ONLY