Copyright 2014 SSH Communications Security Copyright 2014 SSH Communications Security

Espoon-Kauniaisten Osakesäästäjät

May 14, 2014

SSH Communications Security

Jyrki Lalla

CFO

Copyright 2014 SSH Communications Security

Contents

• The Business SSH is in

• Highlights from Q1 / Financial performance

• Going forward

Copyright 2014 SSH Communications Security

Boston, USA

Germany

Helsinki, Finland (HQ)

Hong Kong

UK

= SSH Office = SSH Competence Center

The business SSH is in

• Cybersecurity applications for server access and encryption

in large IT-environments (private and public)

• Key management

• Access management

• Data in transit encryption

• Our customers include more than

half of the biggest financial institution

in USA

• 90% of sales outside Finland

• Patent licensing

Copyright 2014 SSH Communications Security

What is Secure Shell?

• Technology invented by SSH Communication Security in 1995

• Enables corporate to manage access to its information securely :

– Secure remote login (replace Telnet)

– Secure file transfer (replace or secure FTP)

– Secure remote command execution (replace rsh)

– Secure backup and copy

– Secure tunneling of existing unsecured

TCP applications

– Enables authentication for scheduled and automated file

transfers and other tasks where user interaction is not possible

• Is an IETF standard. Open source and commercial implementations are

available for most systems.

Copyright 2014 SSH Communications Security

Where is Secure Shell used?

• SSH protocol is widely used

– by system administrators

– in automated machine-to- machine processes

• SSH protocol is used on

– every Unix/Linux computer

– most cloud computing environments

– more than half of the world’s web sites

– most xDSL modems, routers, telecom exchanges and other network equipment.

• SSH protocol has been in use since 1995 and it is used widely today

– millions of SSH keys are used daily

• SSH protocol is still secure

• But the way corporations are handling keys are not next opportunity

Source: Forrester The Rise Of IT Automation And The New Security Imperatives, Feb 2014

Copyright 2014 SSH Communications Security

Encrypted Data in transit / Key management

20%

of Identities

80%

of Identities

Interactive Access (End User interaction) Protocols Used: TLS/SSL, SSH Market Players: Oracle, Centrify, Likewise, EMC, IBM,...

Automated Access (Machine to Machine) Protocols Used: SSH, SFTP, RSYNC Different segments: - Specialized applications (like IBM websphere, Oracle,..) - Homemade applications - Unix environment

Universal SSH Key Manager™: “manage & govern” •Access management for machine-to-machine communication. •Currently no one else can deliver. •Other players : Venafi

Copyright 2014 SSH Communications Security

The Privileged Access Management a market of c 300M$*

Shared Privileged Accounts

Know who accessed what

account and when

Privileged User Controls

Limit the activities of high privilege

users

Audit and Visibility

Know what privileged uses are

doing

CyberArk CA Dell Quest Xceedium SSH Comm. Sec.

BeyondTrust CA Centrify CyberArk Dell Quest SSH Comm. Sec.

SSH Comm. Sec. BalaBit ObserveIT Xceedium CyberArk

CryptoAuditor™: “content awareness” •Provides capabilities to monitor, control and audit encrypted communication and prevent data loss.

•Other players: Cyber-Ark, BeyondTrust, xCeedium, Balabit.

* Gartner estimation

Copyright 2014 SSH Communications Security

Contents

• The Business SSH is in

• Highlights from Q1 / Financial performance

• Going forward

Copyright 2014 SSH Communications Security

Highlights in Q1

• Sales flat, profitability declined, cash position remained strong

• Sales 2,9M (Q1 2013: 2,9M); -1% YoY

• EBIT -0,9M; -31,1% of net sales (0,1M; 1,9%)

• Cash flow from operations +0,4M (+1,3M), cash position remained strong

• Cybersecurity

• Interests and needs increasing, but deals progressing slowly

• Governmental segment: ”a snowden snowball effect”

• SSH Security and Access management

• Use of SSH protocol ubiquitous and continues to spread (unix, linux, cloud services)

• Management of encryption and server access (key management) remains a real customer problem to be solved.

• Pressure from compliance requirements building up

Copyright 2014 SSH Communications Security

Challenging Q1

• Q1 sales declined by -1%

• Deferred revenue remains

strong

• Weak licence sales a

disappointment

• Sales cycle longer than

anticipated

• Pressure from compliance

requirements building up

• Customer problems more

complicated than anticipated

• Investments in future growth continued

Q1´13 Q2’13 Q3’13 Q4’13 Q1’14

Sales M€ 2,9 3,3 3,0 4,1 2,9

OPEX M€ 2,5 3,0 2,8 3,1 3,2

EBIT M€ 0,1 -0,1 -0,4 0,6 -0,9

% EBIT % 1,9 -1,3 -9,1 14,0 -31,1

Personnel eop 80 86 94 99 101

M€

sales / region

Copyright 2014 SSH Communications Security

Balance sheet allows investing in growth

• Positive cash flow from operations

• Strong cash position remained

2011 2012 2013 Q1´14

B/S M€ 6,4 12,5 13,5 12,2

Cash and cash equivalents M€ 2,4 6,6 6,0 5,8

Cashflow from operations M€ -0,8 1,3 0,4 0,4

ROE % -110 31 2 -14

Equity ratio % 36 70 77 76

Gearing % -230 -105 -80 -89

Profit/loss per share EUR -0,07 0,04 -0,00 -0,03

Equity per share EUR 0,03 0,20 0,24 0,21

Copyright 2014 SSH Communications Security

Contents

• The Business SSH is in

• Highlights from Q1 / Financial performance

• Going forward

Copyright 2014 SSH Communications Security

Patent licensing

• Interim Q2 results/July 24, 2013: CEO´s review:

“The company is also working towards capitalizing on its patent portfolio, which appears to include several essential patents on technologies used in leading smartphones, tablets, state-of-the-art telephony and video conferencing systems, game consoles, and operating systems. The total sales of products using technologies patented by the company may exceed USD 100bn annually. The patent portfolio may generate significant revenue in the future either in the form of revenue from sale of the patents or royalties.”

Copyright 2014 SSH Communications Security

Strategy: Key Actions

Customer buying Universal SSH Key Manager™

Working with press and analysts to create understanding

of the security risk

Copyright 2014 SSH Communications Security

Compliance Requires Action

Multiple Mandates for Secure Shell Controls

PCI-DSS MAS

COBIT ISO27002

SOX HIPAA

NIST FFIEC

Secure Shell Has Impact Across All Domains

Copyright 2014 SSH Communications Security

During 2013 SSH mentioned

almost 10 000 times in media 2014 Press coverage

• USA & Global

• April 14, eWeek, Cisco, Juniper Work to Protect Networking Gear vs. Heartbleed

• April 10, Network World, Who's to blame for 'catastrophic' Heartbleed Bug?

• April 10, Latin Post, 'Heartbleed' Bug Has Everyone Worried, Here's Why

• April 9, Re/code, How Companies Are Reacting to the Heartbleed Security Bug

• April 9, eWeek, Heartbleed SSL Encryption Vulnerability Requires Quick Attention

• April 9, Dark Reading, More Than A Half-Million Servers Exposed To Heartbleed Flaw

• March 7, TMC's M2M Evolution, Big Data, Big Privacy Concerns: Identity Management in a Big Data World

• March 6, Bank Systems & Technology, A Growing Security Risk in IT Automation

• March 5, TechTarget, Survey: Centralized SSH security can help avoid high-profile breaches

• March 3, VIDEO, Huffington Post, SSH Zooms in on Security at RSA

• February 25, CIO Insight, Enterprises Failing to Secure M2M Transactions

• February 24, Channel Nomics, In Internet of Things, M2M Security Gets Short Shrift

• February 24, eWeek, Poor Security Key Management Poses Cyber-Threat to Internet of Thing

• February 20, NetworkWorld, What will be hot at RSA? NSA/tech industry battle; cyberwarfare issues dominate

• February 12, Computerworld, Slick, sick nation-state espionage malware The Mask: Mother of future cyber weapons?

• February 11, CSO, 'The Mask' malware sets standards hackers are sure to follow

• January 2014, TechTarget, SSH security risks: Assessment and remediation planning

• Japan

• February 21, Nikkin, Massive amount of ID and password is a problem

• January 31, IT Pro, SSH key management and encryption monitoring becomes more important

• United Kingdom

• April 11, SC Magazine, 9 expert opinions on the 'Heartbleed Bug'

• March, Components in Electronics, The Weakest Link – How to Best Secure M2M Connections and Protect Encrypted Networks

• March 11, The Guardian, Top Tips to Stop Cyber Criminals from Targeting Your Small Business

• February 27, Ovum, SSH Communications Security Plans TLS/SSL Support in CryptoAuditor

• February, ABI Research, Security in Next-generation Enterprise Networks

• February 25, Pro Security Zone, Rising tide of M2M demanding higher focus on encryption

• February 24, Tech Week Europe, The Internet Of Things Is A Security Disaster

• January 28, Security Park, The Key to Your Organization’s Well-Being Best Practices for Secure Shell Key Management

• Germany

• April 10, Die Welt, Diese Passwörter sollten Sie jetzt ändern

Copyright 2014 SSH Communications Security

Going forward

• Focus on encryption and server access control has

put SSH in an excellent position to solve pressing

data security problems in the enterprise

• Capitalize on 1-2 years lead in SSH Key management

• SSH utilize actively its patent portfolio

• SSH looks opportunities in governmental segment

as a neutral and trustworthy cybersecurity supplier

• SSH continues to invest in market creation,

technology leadership, quality, and customer

success stories for new products.

Copyright 2014 SSH Communications Security

Going forward

In 2014, SSH Communications Security estimates

its revenue to grow significantly and profitability to

improve from 2013. During the first half of the year

the sales growth can be smaller with possibilities

to losses due to timing of sizeable deals.

Copyright 2014 SSH Communications Security Copyright 2014 SSH Communications Security

Thank You!