Interview With Vishram Mishra - Founder at MicroSec

Shauli Zacks
Updated on: November 20, 2024 Content Editor

SafetyDetectives recently sat down with Vishram Mishra, the visionary founder of MicroSec, a leading cybersecurity company addressing the unique challenges of IIoT (Industrial Internet of Things) and OT (Operational Technology) environments. With a PhD in Wireless Communication and over a decade of expertise in cryptography and sensor networks, Mishra has dedicated his career to bridging the security gaps in low-power, constrained devices critical to industries like energy, transportation, and smart infrastructure. In this interview, Mishra shares the inspiration behind MicroSec, insights into their innovative solutions, and the future of cybersecurity in a rapidly evolving digital landscape.

Can you share your journey in founding MicroSec and what inspired you to start a company focused on cybersecurity?

Cybersecurity has always excited me, especially reverse engineering and bypassing methods of security controls. After completing my PhD in Wireless Communication from Nanyang Technological University, Singapore, I was drawn to the challenge of securing embedded systems. With over a decade of experience in cryptography protocols and sensor networks, I observed a significant gap in security for low-power and low-bandwidth OT & IIoT devices. This realization inspired me to found MicroSec in 2016, with a mission to provide enterprise-grade security tailored for OT & IIoT systems, bridging the gap in safeguarding these critical infrastructures.

MicroSec is known for its innovative solutions, including LCMS and MicroIDS. Why are these products essential in addressing the cybersecurity challenges posed by IIoT (Industrial IoT) and OT (Operational Technology) environments?

The proliferation of IIoT and the convergence of OT with IT devices have introduced new vulnerabilities and attack surfaces, making them attractive targets for cyberattacks. Traditional security measures often fall short due to the legacy and constrained nature of these devices. MicroSec’s LCMS (LifeCycle Management System) provides a robust framework for post-quantum authentication and encryption, ensuring data integrity and device authenticity while enabling security-by-design. Meanwhile, MicroSec’s MicroIDS (Micro Intrusion Detection System) delivers real-time threat detection across OT and IoT networks, identifying zero-day attacks and vulnerabilities with comprehensive protocol coverage. By integrating these solutions, MicroSec offers a defense-in-depth approach that addresses the unique challenges of IIoT and OT security, providing scalable and efficient protection against evolving threats.

How does MicroSec approach the challenge of securing IIoT & OT devices, which are often seen as vulnerable entry points for cyber threats?

MicroSec secures IIoT and OT devices by focusing on key functionalities that address threat management, vulnerabilities and enable security by design:

• Device-Level Protection: Implements lightweight solutions for detecting anomalies, malware, and tampering in real-time, ensuring robust security for constrained and heterogeneous devices.
• Network Threat Detection:Delivers advanced intrusion detection capabilities, identifying zero-day attacks and vulnerabilities using distributed AI-driven and rule-based analytics.
• Secure Authentication and Communication: Utilizes post-quantum cryptography and lifecycle management to ensure data integrity, device authenticity, and secure communication.
• Automated Compliance and Vulnerability Assessment:Streamlines industrial cybersecurity assessments (e.g., IEC-62443, NIST SP 800) with real-time insights into security posture, reducing risks at both device and site levels.
• Software Supply Chain Security:Embeds security throughout the software lifecycle, validating the integrity of firmware, updates, and dependencies.

These functionalities deliver a layered defense approach, mitigating risks and securing IIoT and OT systems against evolving threats while enabling secure operations from the ground up.

With the growing integration of IIoT devices in various industries as well as the overlap of IT in the OT sector, what are the emerging security threats you foresee in the near future?

The increasing integration of IIoT devices and the convergence of IT and OT systems are creating new attack surfaces and security challenges. Emerging threats include:

• Advanced Persistent Threats (APTs): Sophisticated, long-term attacks targeting critical infrastructure to disrupt operations or exfiltrate sensitive data.
• Ransomware Targeting OT Systems: Attackers encrypt or disable OT systems, causing operational downtime and pressuring industries to pay hefty ransoms.
• Supply Chain Vulnerabilities: Compromises in firmware, software updates, or third-party components can propagate vulnerabilities across systems.
• Cross-Domain Threats: The overlap of IT and OT increases the risk of malware or attackers moving laterally between systems.
• Zero-Day Exploits: Attackers leveraging undiscovered vulnerabilities in IIoT devices, which are often hard to patch due to their constrained nature.
• Insider Threats: Malicious or unintentional actions by employees or contractors compromising IIoT and OT systems.

Proactive security measures such as real-time monitoring, anomaly detection, robust authentication mechanisms, network segmentation, automated compliance assessments, and post-quantum cryptographic protections are essential to mitigate these evolving risks. A defense-in-depth strategy that combines endpoint protection, intrusion detection systems, and secure lifecycle management further strengthens an organization’s ability to combat emerging threats effectively.

What are the most common misconceptions businesses have about IIoT & OT security, and how does MicroSec address them?

A few common misconceptions about IIoT and OT security include:

• “Legacy Systems Are Secure by Isolation”: Many businesses assume that legacy OT systems are secure because they operate in isolated environments. However, the increasing integration with IT systems and IIoT devices exposes these systems to cyber threats.
• “Standard IT Security Solutions Are Sufficient”: Traditional IT security measures often cannot account for the unique constraints and requirements of IIoT and OT devices, such as low power, limited bandwidth, and long life cycles.
• “Compliance Equals Security”: Businesses often equate meeting compliance standards with being fully secure. Compliance is essential but does not address evolving threats or zero-day vulnerabilities.
• “Devices Are Too Small or Unimportant to Be Targeted”: Many believe that individual devices are insignificant to attackers. In reality, even small devices can serve as entry points for attacks on critical infrastructure.
• “OT Security Doesn’t Require Frequent Updates”: Some businesses believe that OT devices, once deployed, don’t need regular security updates. This leads to vulnerabilities being left unaddressed.

MicroSec addresses these misconceptions with:

• Real-Time Monitoring and Segmentation: MicroSec provides network segmentation and continuous monitoring to secure legacy systems against connectivity-induced vulnerabilities.
• Lightweight, Tailored Security Solutions: MicroSec delivers optimized protection specifically designed for low-power, constrained IIoT and OT devices, ensuring security without performance trade-offs.
• Beyond Compliance with Dynamic Threat Protection: MicroSec enhances security beyond compliance requirements by deploying real-time anomaly detection and addressing zero-day vulnerabilities.
• Device-Level Protection: Lightweight agents secure even the smallest devices with tampering detection, malware prevention, and cryptographic safeguards.
• Software Supply Chain Security: MicroSec ensures secure firmware updates and lifecycle management to continuously protect OT systems from emerging threats.

By dispelling these misconceptions and offering tailored, proactive solutions, MicroSec empowers businesses to confidently secure their IIoT and OT environments.

How does MicroSec’s CyberAssessor improve the accuracy and efficiency of security assessments in industries that rely on IoT and OT devices?

CyberAssessor is an AI-driven platform that automates cybersecurity assessments, supporting compliance with multiple standards and frameworks, including IEC 62443, ISO 27400, NIST SP 800, IACSUR E26, E27, Singapore’s TR64, and CIS Benchmarks. It enhances compliance evaluation accuracy across sites and down to the device level, including third-party equipment, hardware, and software. By providing a comprehensive summary through a “single pane” dashboard and generating automatic reports detailing risk levels, compliance scores, and recommendations, CyberAssessor streamlines the assessment process, reducing manual input and minimizing human error.

What is next for Microsec?

MicroSec is expanding from APAC to Europe, the Middle East, and North America, targeting millions of devices across diverse sectors, including energy, transportation, smart infrastructure, maritime, and mining. The company is focusing on securing the supply chain from OEMs to end users, ensuring robust protection throughout the lifecycle of devices and systems. Continued investment in advanced cybersecurity research, including AI-driven analytics, post-quantum cryptography, and zero-trust architectures, enables MicroSec to address evolving threats and support diverse industries globally. Through tailored solutions and strategic collaborations, MicroSec aims to lead in IIoT and OT security on a global scale.