Securing Remote OT and SCADA Over Satellite and Private 5G: A Practical Cybersecurity Guide

Operational technology (OT) runs the physical world: pumps, breakers, valves, and field sensors. At a remote mine or wellsite, that OT depends on a SCADA system. SCADA means Supervisory Control and Data Acquisition. It is the hardware and software that monitors and controls field equipment.

Most OT security advice assumes a fixed plant with a wired backbone and IT staff down the hall. Remote sites break that assumption. The wide area network is satellite, and the access layer is private wireless. On-site IT is thin or absent.

The frameworks still apply at these sites. What changes is the transport layer they have to account for. This guide covers both.

Key takeaways

• A private 5G network or private APN is not a secure network. You still need segmentation, access control, encryption, and monitoring.
• Apply recognized frameworks (IEC 62443 zones and conduits, NIST SP 800-82, the Purdue model) all the way down to the satellite and private 5G layers.
• Separate IT from OT with an industrial DMZ. Never expose SCADA directly to the WAN.
• Secure remote access with zero trust and MFA. Retire always-on VPN tunnels into OT.
• Encrypt data in transit over satellite. Deploy ICS-aware monitoring so you can see activity.
• Decide who operates it. A managed model closes the gap that thin on-site staffing leaves behind.

Start with the frameworks

Three references anchor OT security, so treat them as a checklist rather than academic reading.

IEC 62443 splits a network into zones and conduits. A zone groups assets with the same security needs. A conduit is the controlled path between two zones. Every conduit gets a defined and monitored connection.

NIST SP 800-82, the US Guide to OT Security, maps controls to industrial realities. It accounts for uptime pressure, legacy controllers, and safety.

The Purdue model layers a network from field devices to business IT, giving every asset a place to sit. That shared map is where IT/OT convergence either stays safe or goes wrong.

All three agree on one rule. Separate your levels and control what crosses between them.

The myth: private means secure

A private 5G network or a private APN feels closed. Closed sounds safe, but it is not the same as secure.

APN means Access Point Name, the gateway a cellular device uses to reach a data network. A private APN keeps your traffic off the public internet and hands you a private address space.

That helps, and your devices stay hidden from the open internet. It does nothing about a compromised laptop already inside the network. It does nothing about a contractor with more access than the job needs. It will not stop a camera VLAN from reaching your SCADA controllers.

A private path controls who reaches the network. Real security controls what they can do once inside. You need both layers. Galaxy builds private 5G for remote industrial sites with that distinction in mind.

Segment everything

Segmentation does the most work at a remote site, so start with a clean split between IT and OT.

Place an industrial DMZ (IDMZ) between them. An IDMZ is a buffer zone where IT and OT exchange data through brokers and proxies. Neither side talks to the other directly. A historian or patch server lives here, not raw control traffic.

Below that, carve the site into VLANs. A VLAN is a logical network that isolates traffic on shared hardware. Give SCADA its own VLAN, and isolate IoT sensors, staff, contractors, and morale Wi-Fi the same way.

The payoff is blast radius: a phished worker on the morale network never reaches a programmable logic controller. Galaxy’s IoT/SCADA connectivity and the GiiG gateway enforce these zones in hardware at the edge. The policy travels with the site.

Secure the satellite link

Remote OT often backhauls over LEO satellite. LEO means Low Earth Orbit. These constellations cut latency far below older geostationary links, which makes them workable for control traffic.

Encrypt everything in transit, because the satellite link is a public path between your site and the core. SCADA data needs encryption end to end, so do not rely on the carrier alone.

Latency and bandwidth still set limits. Security tooling can be chatty, and a full packet feed to a cloud sensor may saturate a modest link. Tune monitoring to send metadata and alerts, not full packet captures a remote link cannot carry. Galaxy’s OneWeb LEO service gives the low-latency headroom that makes encrypted OT traffic and live monitoring practical.

Secure remote access

Remote sites need remote support, and that access is the most common way in for an attacker.

Retire always-on VPN tunnels into OT. A standing tunnel turns one stolen credential into a direct route to control systems. It stays open whether anyone is using it or not.

Move to zero trust network access (ZTNA). ZTNA grants access per session, to one application, after it checks the user and device. Pair it with multi-factor authentication (MFA), which requires a second proof beyond a password.

Route every session through a jump server. A jump server is a single hardened gateway that brokers access into the OT zone. Nobody reaches a controller without passing through it first, which logs every session.

See what is happening

You cannot defend assets you cannot see, so visibility comes first.

Build an asset inventory that lists every controller, sensor, and switch with its firmware and address. Most OT breaches start with a device nobody knew was online.

Add ICS-aware monitoring. An industrial intrusion detection system (IDS) understands protocols like Modbus and DNP3. It flags a command that a normal process would never send. Generic IT tools miss that context.

Watch for anomalies in behavior, since signature lists miss novel attacks. A pump that shifts its setpoint at 3 a.m. deserves an alert, even with no malware in sight.

Operate it: patching and the managed model

OT patching is hard, since you cannot reboot a running process on a whim. Many controllers carry vendor warnings against unscheduled updates. Patch windows are rare and tightly planned.

When you cannot patch fast, compensate. Virtual patching at the firewall blocks the exploit path while the device waits for its real fix. Segmentation buys the same time.

That workload assumes someone is watching. Thin on-site staffing is the real gap at remote operations. A managed model closes it. Managed firewalls, GiiG segmentation, and a 24/7 network operations center (NOC) give the site continuous coverage. A committed information rate (CIR) reserves bandwidth for critical flows. Quality of service (QoS) rules then keep control traffic ahead of everything else when the link is busy. Galaxy’s SmartSite managed service runs that operation end to end.

FAQ

What is OT and SCADA security, and how is it different from IT security?

OT security protects the systems that run physical equipment. SCADA security is the part that protects the supervisory layer controlling that equipment. IT security guards data and prioritizes confidentiality. OT security guards a physical process and prioritizes safety and uptime, which changes how you patch and segment.

Is a private 5G network or private APN enough to secure a SCADA system?

No. A private network or private APN keeps your traffic off the public internet. It does not segment internal systems, control user access, or detect intrusions. You still need segmentation, zero trust access, encryption, and monitoring on top.

How do you secure a SCADA system at a remote site?

Separate OT from IT with an industrial DMZ. Put SCADA on its own VLAN. Replace always-on VPNs with zero trust access and MFA through a jump server. Encrypt the satellite link and run ICS-aware monitoring.

How do you protect OT data sent over a satellite link?

Encrypt it end to end so the carrier and any intermediary cannot read it. Tune monitoring to send alerts and metadata, which respects the limited bandwidth a remote link carries.

Which frameworks apply to OT and SCADA security?

IEC 62443 defines zones and conduits for industrial systems. NIST SP 800-82 is the US guide to OT security. The Purdue model layers the network from field devices to business IT. Used together, they tell you how to separate levels and control what crosses between them.

Why is SCADA security important?

A SCADA compromise can move from a network into the physical world. That means stopped production, damaged equipment, environmental release, or risk to crew. The stakes are higher than data loss alone.

Talk to an expert

Securing remote OT and SCADA is a design problem before it is a product purchase. The right segmentation, access model, and monitoring depend on your sites and equipment. They also depend on who runs the network each day.

Do you run critical operations over satellite or private wireless? Galaxy can help design segmented, monitored, managed connectivity around them. Ask an expert for a connectivity and security assessment of your OT environment.