Security Made Simple

In the asymmetric battle between hackers and the rest of us, cyberattacks can affect not only virtual systems but also physical ones. One of the most terrifying examples of how cyberattacks can compromise physical systems is the Stuxnet attack, which targeted the Natanz nuclear power plant in Iran in 2010.

Spread through infected USB thumbdrives, Stuxnet malware is thought to have infected over 200,000 computers before eventually finding its way to the programmable logic controllers which governed the centrifuges used to enrich uranium fuel. Once there, Stuxnet was able to hijack the centrifuges, making them spin at destructively high speeds and causing them to tear apart.

Vishram Mishra, co-founder of MicroSec

“The Stuxnet attack is an example of what can happen to Internet of Things (IoT) devices at the industrial scale,” says Vishram Mishra, co-founder of MicroSec, a startup developing the world’s first enterprise-grade security for IoT and sensor networks. “As consumers continue to add billions of IoT devices to communication networks around the world, we are going to see more frequent attacks as more and more points of weakness are introduced.”

According to technology research firm Gartner, there will be 8.4 billion IoT devices in use by the end of 2017 and more than 20.4 billion by 2020, a number that translates to an average of two to six devices for every person on the planet. This army of IoT-enabled devices is expected to help us capture information about everything from our fridges to our heart rates, and to make smart, data-driven decisions automatically on our behalf.

But the main advantage of IoT devices—their small size and affordability—is also their Achilles’ heel when it comes to security. Since the true strength of IoT lies in its scale, it needs to be affordable to deploy a large number of devices or sensors. However, this limits the number and complexity of functions that IoT devices are able to perform, including security measures.

Mishra speaking on the bandwidth and power consumption constraints faced by IoT devices

“The problem that the industry faces is that IoT devices are constrained in terms of bandwidth and power consumption,” Mishra explains. “Most devices are supposed to run either on battery power or communication technologies which don’t provide enough bandwidth, making it challenging to provide security in addition to the basic sensing function.”

MicroSec’s solution is a security ecosystem that has been optimised to be as energy and bandwidth efficient as possible. The company provides security solutions that cover communications from sensor nodes to intermediaries, and intermediaries to data centres by providing authentication, key exchange, key management and encryption protocols.

“On top of that, we make sure that the data is encrypted whenever it is in motion, whether at the network communication level or the application level,” he continues. “This allows secure communication over private and even shared networks.”

Since MicroSec’s security ecosystem is protocol agnostic, meaning that it is compatible with the different existing IoT protocols, the use cases for their technology are “almost unlimited”, Mishra says. The company currently is providing security to companies in Singapore and the UK who are using IoT for asset tracking, energy and environmental monitoring, among others. 

The construction industry, for example, uses temperature and humidity sensors to determine if a floor has been cured before proceeding to build the next floor on top of it. 

Dr Magzhan Ikram & Vishram Mishra, co-founders of MicroSec, a company that was built from the first cohort of EF Singapore

“One of our construction clients had previously assumed that their sensors were secure because the commonly used Zigbee communication protocol has a limited range, and a would-be attacker would have to physically breach the construction site to compromise the system,” said Mishra. “However, it is now possible for a drone carrying a Zigbee module to get close enough to launch an attack, prompting them to work with us to secure their sensitive construction sites.”

MicroSec is also conducting a trial with a company working on internet protocol surveillance cameras, providing full end-to-end encryption on all video frames so that they can be securely transmitted even over the internet or Wi-Fi.

Getting MicroSec to this point in a matter of months—the company was incorporated in December 2016—was only possible with the help of SGInnovate and Entrepreneur First (EF), he adds.  Although he had always wanted to draw from his background in deep technology to build his own security solutions, Mishra found that he did not have enough business experience.

Dr Magzhan Ikram & Vishram Mishra, co-founders of MicroSec

EF, a London-based company builder, launched its Singapore branch in 2016 – its first expansion abroad. “EF was the perfect fit for me, accepting me into their programme even though I did not have a team at that point,” shares Mishra. “Within three months of joining them, I found my co-founder Dr Magzhan Ikram, a mathematics expert who handles the optimisation of the cryptography.”

MicroSec co-founder, Dr Magzhan Ikram

SGInnovate has also helped the fledgling startup with two of their biggest pain points: hiring and business contacts. Apart from sending MicroSec a steady stream of relevant CVs, SGInnovate has helped the company get in touch with about half the companies and government agencies that they are currently in negotiations with.

Mishra says “I see SGInnovate as a community—an awesome community—where you can get all the help that you need. They don’t just give you money but they really work with you to help your company grow.” 

MicroSec is a company that was built from the first cohort of EF Singapore. The application to join the third cohort is open till 30 Nov 2017.