For a well pad forty miles from the nearest fiber run, a lift station behind a levee, or a compressor site in a canyon, cellular is not a fallback - it is the only practical way to get SCADA data out. And done carelessly, it is also how PLCs end up directly reachable from the public internet: a cellular modem with a public IP, port forwarding enabled, and a default password is an open invitation indexed by scanners within hours. This guide covers how to run 4G and 5G SCADA connectivity properly - the cellular threat model, private APNs versus outbound-only architecture, SIM security, TLS and device identity, signed telemetry, store-and-forward buffering, and secure gateway updates - so remote sites are as defensible as the ones on plant ethernet.
One of 60+ guides in our SCADA security and compliance series.
Trenching fiber to a tank battery is not going to happen, licensed radio takes planning and towers, and satellite has latency and cost issues for continuous telemetry. LTE coverage now blankets most producing regions, hardware is cheap, and a data plan for SCADA-scale telemetry costs less per month than one truck roll. That is why cellular has quietly become the default transport for distributed operations - pipelines, oil and gas fields, water districts, and irrigation networks alike. Our guide to pipeline SCADA monitoring shows how much of that industry runs on exactly this pattern.
But cellular changes the security question in one fundamental way: there is no plant fence. On plant ethernet, your OT network is at least nominally bounded by your own firewall. A cellular gateway talks across a carrier's network and, usually, the public internet. You cannot secure the transport - you do not own it. You can only decide what the device does with it. That reframing is the whole discipline of cellular SCADA security: treat the cellular network as untrusted, and put every protection above it - in the gateway's connection behavior, its identity, and its data handling.
What can actually go wrong on a cellular-connected site? The realistic threats, in rough order of likelihood:
Notice what is absent: exotic radio attacks. IMSI catchers and baseband exploits exist, but a defense that assumes untrusted transport already covers them - the attacker who intercepts your traffic gets TLS ciphertext and signed envelopes either way.
Three architectures dominate cellular SCADA deployments, and they distribute cost and risk very differently:
| Attribute | Public IP + Port Forwarding | Private APN / Cellular VPN | Outbound-Only Gateway |
|---|---|---|---|
| Internet exposure | Full - device is a scannable public address | None from internet; devices live on a closed carrier network | None - nothing listens; connections originate at the site |
| Recurring cost | Static-IP surcharge | APN setup + monthly fees; carrier lock-in | Standard data SIM |
| Static IP needed | Yes | Usually managed by carrier | No - works behind carrier-grade NAT |
| Carrier dependence | Low | High - APN tied to one carrier's provisioning | Low - any SIM with data service works |
| Security if one device is compromised | Device fully exposed both ways | Lateral movement risk across the APN's flat network | Compromise yields an outbound pipe, not an inbound door |
| Where trust lives | Nowhere - hope | In the carrier's network boundary | In TLS, device credentials, and signed telemetry - verifiable end to end |
| Verdict | Never acceptable | Good, especially for inbound-dependent legacy gear | Preferred - security does not depend on the carrier |
A private APN - a closed network the carrier provisions so your SIMs never touch the public internet - is a legitimate, strong control, and the right call when legacy devices must accept inbound connections (classic poll-response RTU setups). Its weaknesses are cost, carrier lock-in, and a subtle one: the APN is a perimeter, and everything inside it typically trusts everything else, so one compromised field device can probe its neighbors. The outbound-only pattern - the same architecture we recommend for all SCADA remote access - needs nothing from the carrier: the gateway initiates TLS connections outward, carrier-grade NAT blocks all unsolicited inbound traffic as a side effect, and security is enforced end-to-end where you can verify it. The two compose well: an outbound-only gateway inside a private APN is defense-in-depth for high-consequence sites.
The SIM authenticates your device to the carrier and meters your bill - it does nothing for platform security, but mishandled, it becomes a small liability. The practical checklist:
Because the transport is untrusted, the gateway itself must carry the trust. This happens in layers, and it is worth asking any vendor to walk you through theirs. In Merobix, every gateway is registered with unique per-device credentials - no fleet-wide shared secret, so one compromised site never unlocks the rest - and each device generates its own Ed25519 signing identity (the EdDSA signature scheme standardized in RFC 8032). All traffic to the platform travels over TLS - the current version of which is specified in RFC 8446 - and telemetry rides in signed envelopes carrying sequence numbers, timestamps, sample IDs, and payload digests, with replay detection on the receiving side. An attacker who intercepts cellular traffic sees ciphertext; an attacker who tries to inject or replay readings fails signature and sequence checks. The platform also validates control-tag authorization and setpoint bounds independently of transport, so even the write path does not trust the network.
The same skepticism applies to software: a gateway at an unattended site must not accept an unauthenticated firmware push. Merobix gateway artifacts are signed, with update verification before anything installs, and the engineering roadmap extends this further - immutable, versioned gateway installs with atomic activation and rollback, and provenance bound to the cloud release, are being built now. For the full edge-device story, see our guide to edge gateway security; for why payload signing matters even over TLS, see telemetry integrity in cloud SCADA.
Cellular coverage at industrial sites is good until it isn't - a storm cell, a congested tower during a local event, an outage upstream. A gateway designed for cellular treats disconnection as a normal operating state, not an exception. The local side keeps working: the gateway continues polling PLCs and RTUs over its local connections (Merobix drives drivers for the major industrial protocols (Modbus, DNP3, OPC UA, EtherNet/IP, Siemens S7, and MQTT) - Modbus RTU and TCP, OPC-UA, MQTT, DNP3, BACnet/IP, EtherNet/IP, and HTTP), and every reading lands in a store-and-forward buffer. When the connection returns, the backlog uploads and backfills the historian with original sample timestamps and sequence numbers preserved - so your trend for the outage window is complete, in order, and still protected against replay, rather than a flat-lined gap. On the platform side, telemetry is accepted durably before historian processing, so a reading that arrives is a reading that persists.
Two questions separate real store-and-forward from a brochure checkbox: how long is the buffer at my polling rate, and how is backfilled data timestamped? Demand specific answers. A buffer measured in minutes, or backfill stamped at arrival time instead of sample time, both mean your compliance records will have holes exactly when weather is worst.
Key takeaway: Cellular SCADA is secure when you stop trusting the cellular network. No public IPs, no port forwarding, no inbound anything - an outbound-only gateway with unique device credentials, TLS, signed telemetry with replay protection, and store-and-forward buffering gives a remote site on a $30 SIM a stronger security posture than most wired deployments with open firewall ports. That is the architecture the Merobix gateway ships with, documented on our security page - and you can watch a cellular site stream, drop offline, and backfill in a live demo.
Yes - when the architecture is right. Cellular is not inherently less secure than wired connectivity; what matters is what the gateway does with it. A secure cellular SCADA deployment uses an outbound-only gateway that initiates TLS-encrypted connections to the platform, never accepts inbound connections, authenticates with unique per-device credentials, and buffers data locally during coverage gaps. The failures associated with cellular SCADA - exposed modem admin pages, public IPs with port forwarding to PLCs, default passwords on carrier equipment - are configuration failures, not properties of cellular itself. Treat the cellular network as untrusted transport, encrypt and authenticate above it, and 4G/5G becomes a perfectly sound way to monitor remote sites.
A private APN - a carrier-provided closed network that keeps your SIMs off the public internet - is a strong control, but it is not mandatory for a secure deployment and it adds recurring cost and carrier lock-in. Private APNs make the most sense when devices must accept inbound connections or talk to each other, because they remove public exposure. With an outbound-only gateway architecture, the security burden shifts to TLS, device authentication, and signed telemetry, which work identically over a standard consumer or business SIM. Many operators run outbound-only gateways securely on ordinary SIMs behind carrier-grade NAT; a private APN then becomes defense-in-depth rather than a prerequisite.
Treat the SIM as a credential and the gateway as the thing that holds it. Set a SIM PIN so a stolen SIM cannot be used in another device; use carrier features to lock the SIM to the gateway's IMEI where available; disable SMS and voice on data-only plans to shrink the attack surface; set data-usage alerts and caps so a stolen or misused SIM shows up on a dashboard quickly; and use the carrier portal to suspend SIMs the moment a site is decommissioned or a gateway is replaced. Physically, mount gateways inside locked enclosures - SIM theft from unattended cabinets at remote sites is a real, low-tech risk. Finally, remember the SIM only authenticates to the carrier: platform security must come from device credentials and TLS, not from the SIM.
With a properly designed gateway, nothing is lost. The gateway keeps polling PLCs and RTUs locally - the local connection to instruments does not depend on the cell network - and buffers readings in store-and-forward memory. When connectivity returns, the buffered history uploads and backfills the historian, so trends show a complete record rather than a gap. The Merobix gateway works this way, and its telemetry pipeline preserves sample timestamps and sequence numbers, so backfilled data lands at the correct historical time with replay protection intact. When evaluating vendors, ask how long the buffer lasts at your polling rate and how backfilled data is timestamped - both answers should be specific.
No - and if a vendor says it does, that is a red flag about their architecture. A static IP is only needed when something connects inbound to the gateway, which is exactly the pattern to avoid: a static public IP on a cellular modem is a permanent, scannable address on the internet, and port-forwarding through it exposes your PLCs directly. An outbound-only gateway initiates all connections itself, so it works behind carrier-grade NAT with a dynamic address on an ordinary SIM. Carrier-grade NAT, often considered an inconvenience, actually works in your favor: unsolicited inbound traffic cannot reach the device at all.
Outbound-only 4G/5G gateways with unique device identities, signed telemetry, and store-and-forward buffering - see a cellular site stream live, drop offline, and backfill without losing a sample.