The short answer
Segmenting a Remote Site
A remote site is a zone of its own: everything at the site is inside it, the link to the plant is its one conduit, and a small firewall or a router with rules at the site end decides what crosses. The plant polls the site controller on its protocol and nothing else reaches the controller; the site controller reaches the plant SCADA and nothing else; the cellular modem or radio is the transport, not a member of the control segment, and its management interface faces the plant, not the internet; a camera or an intrusion panel at the site is on its own segment with its own path and never on the controller VLAN; and engineering access to the site controller arrives through the plant, through the jump host and the site conduit, not through a modem with a public address. The site runs on local control when the link is down, so that the segmentation costs nothing in resilience, and the minimum for a site with one switch is a router with rules, unique credentials, and no public address on anything.
Key points
- The site is a zone; the link to the plant is its one conduit; a firewall or a router with rules sits at the site end.
- The plant polls the controller and nothing else reaches it; the controller reaches the SCADA and nothing else.
- The modem or radio is transport with its management facing the plant; no public address, no port forwarding, ever.
- Cameras, intrusion panels, and anything with a cloud service are on their own segment and path, never with the controller.
- Engineering access arrives through the plant jump host and the site conduit, not through the modem.
- Local control makes the segmentation free: the site does not need the link to run.
What is at a site
A typical remote site has a controller or a remote unit with a few I/O points, a radio or a cellular modem, sometimes a small managed or unmanaged switch, a local HMI panel, a power monitor or a generator controller with a network card, and increasingly a camera or an intrusion panel that someone wants to see from a phone. It has a fence, a panel with a lock, and no staff. Its connection to the plant is a radio channel or a cellular link with a bandwidth measured in kilobits. It is the most exposed part of the utility, because the modem is one configuration mistake from the internet and the panel is one bolt cutter from anyone, and it is the part the utility visits least.
The design
| Element | Design | Why |
|---|---|---|
| Zone | The site is one zone; devices at the site are its members | Small enough to have one set of rules |
| Conduit | The link to the plant, radio or cellular, carrying the polling protocol and the engineering path | One path to review, one path to monitor |
| Site boundary device | A small industrial firewall or a router with rules at the site, or the modem itself where it has a real firewall | Rules enforced at the site end, where the exposure is |
| Rules inbound | From the plant SCADA address to the controller on the polling port; from the jump host to the controller on the programming port during a change window | Nothing else; the modem management from the plant management address |
| Rules outbound | From the controller to the SCADA on the polling port for unsolicited messages; from the controller to the time source; nothing to the internet | A controller that can reach the internet is a controller that can be reached |
| Transport | Cellular modems on a private network or a VPN to the plant, with private addresses; radios encrypted | No public address on any site device |
| Other devices | Cameras, intrusion panels, power monitors on their own segment with their own path, or on the plant side of the site firewall | A camera with a cloud service is an internet connection; it does not share a segment with the controller |
| Local control | The controller runs the site on local logic and floats or backup control without the link | The site is safe whether or not it can talk |
The modem
The cellular modem is the device that most often turns a remote site into an internet-facing controller. Delivered with a public address, a web management page, and port forwarding rules that a well-meaning integrator added so that the SCADA could poll, it presents the controller to the world. The design puts the modem on a private carrier network or a VPN tunnel to the plant so that it has no public address at all, disables the management page from the cellular side and leaves it reachable only from the plant, removes every port forward, changes the default credentials, and updates the firmware. The external vulnerability scanning service from the federal cybersecurity agency will confirm that nothing at the site answers from the internet, which is the test.
Engineering access
The engineer who needs to program the site controller connects to the plant through the jump host with multi-factor authentication, and from the jump host reaches the site controller through the site conduit on the programming port, during a change window, with the session logged. The site firewall rule that permits it can be enabled for the window and disabled after, on firewalls that support scheduled rules. What the design does not include is a modem with a dial-in or a public address that lets an engineer, or anyone, reach the controller directly from a laptop in the field; the field engineer connects with a cable inside the locked panel, which is a physical control and a logged visit.
The minimum
- 1
No public address
Private carrier network or VPN for cellular; encrypted radio; the scan from outside shows nothing.
- 2
Rules at the site
A router or a small firewall permitting the polling conduit and the engineering path from the plant, and nothing else, in both directions.
- 3
Unique credentials
The controller, the modem, the switch, and the HMI each with their own password, vaulted, not the defaults.
- 4
Separate the extras
The camera and the intrusion panel on their own segment and path, or not at the site.
- 5
Local control
Tested by disconnecting the link and watching the site run.
- 6
Monitor
Communication status, modem status, panel intrusion, and site power on the SCADA, with alarms.
- 7
Record
The site in the inventory with its addresses, devices, versions, and the site firewall rules; the drawing shows the zone.
Frequently asked questions
- The modem has a firewall built in. Is that enough?
- If it enforces rules on the cellular side and the LAN side, logs, and can be configured to permit only the conduit, it can serve as the site boundary device. Many modems have a capable firewall that ships wide open; the configuration is what matters, and it is backed up and baselined like any firewall.
- How does the SCADA poll the site if nothing is forwarded?
- Over the VPN or the private network: the SCADA reaches the site controller at its private address through the tunnel, and the site firewall permits that source on that port. Port forwarding is for public addresses, which the site does not have.
- We have fifty sites. Is a firewall at each affordable?
- Small industrial routers with firewall rules cost a few hundred dollars per site, and the modem firewall may already be there. Against fifty exposed controllers, it is the best purchase the security program makes. Standardize the configuration and push it to every site.
- What about sites on licensed radio with no internet at all?
- They are better off than cellular sites and still benefit from rules at the site end, because the radio network is shared by every site and a compromised site can reach the others. Encrypt the radio, restrict the site to its conduit, and keep the extras off the control segment.
Related topics
- Zones and ConduitsThe IEC 62443 way to segment a control system: grouping assets into zones with a shared security level, inventorying every conduit between them, and turning the drawing into firewall rules. With a worked water utility example.
- VLAN SegmentationUsing VLANs to build the zones of a control network on shared switches: what a VLAN separates and what it does not, the zone-to-VLAN mapping, trunks and the native VLAN, routing only through a firewall, and where separate hardware begins.
- Industrial FirewallsFirewalls built for control networks: how they differ from office firewalls, where they belong in a utility network, transparent versus routed modes, Modbus and DNP3 awareness, logging, and the ruggedized units that protect one controller or a remote site.
- Lift Station Backup ControlHow a lift station keeps pumping when the transmitter, the PLC, or the SCADA link is gone: float backup logic, the control transfer relay, redundant-off protection, and how to test it with the controller actually dead.
- SCADA CommunicationsHow SCADA servers talk to controllers and the field: polling and report by exception, the protocols and what each is for, media from plant Ethernet to radio and cellular, poll rate arithmetic, timeouts and quality, time sync, store and forward, and security.
- Jump HostsThe one machine every remote session must pass through: what a jump host is, how it is hardened, what it may reach, session recording, the tools it carries, and why a vendor laptop never gets past it.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.