Cybersecurity for IIoT: Protecting Industrial Data Without Sacrificing Remote Visibility

Cybersecurity is no longer just an IT concern. It is an operational necessity.

Recent cyber incidents have targeted water and wastewater utilities across at least seven states, disrupting operations by changing PLC passwords, modifying network settings, and locking operators out of internet-connected equipment. In response, federal agencies are urging utilities to disconnect vulnerable PLCs from the public internet and strengthen protections around operational technology.

These incidents reinforce an important message for every industrial organization: Any internet-facing device can become a potential entry point when ports are exposed, default credentials remain in place, or access is not properly controlled.

Remote monitoring can provide significant operational benefits, but convenience should never come at the expense of protection. Organizations must understand how their equipment communicates, where potential vulnerabilities exist, and what safeguards are being used throughout the system.

Why Open Ports Create Industrial Cybersecurity Risks

A network port is a communication point that allows data to travel to or from an internet-connected device.

Think of a PLC as a bus carrying process data. The ports are like windows that allow information to move in and out. When those windows are properly secured, the system can communicate as intended. When a port is unnecessarily exposed to the public internet, however, an attacker may have an opportunity to access the device.

This is particularly concerning in industrial environments because exposed ports may provide a path to PLCs, controllers, sensors, network equipment, or other operational assets.

Two ports commonly associated with industrial networks include:

• Port 502, the default TCP port for Modbus TCP
• Port 161, commonly used by the Simple Network Management Protocol, or SNMP

When industrial communication ports are publicly exposed or incorrectly configured, unauthorized users may be able to monitor network activity, intercept traffic, or send malicious commands to connected equipment. SignalFire recommends working with both OT and IT teams to ensure internet-facing ports are closed, protected by appropriate firewall rules, and accessible only by trusted systems.

Default Credentials Are Not Enough

Open ports are only one part of the risk. Weak, reused, or default credentials can also leave industrial systems vulnerable.

Many PLCs and industrial devices are initially configured with credentials that are published in product manuals or readily available online. When those credentials are never changed, an attacker may not need sophisticated tools to gain access.

Organizations should establish password policies that include:

• Replacing all factory-default credentials
• Using strong, unique passwords for every system
• Storing passwords in an approved password manager
• Limiting credentials to the employees who need them
• Enabling two-factor or multi-factor authentication wherever possible

Cybersecurity is most effective when technology, access policies, and employee practices work together.

How SignalFire RANGER Devices Communicate

SignalFire’s RANGER family of cellular IIoT transmitters connects field data from supported sensors and instrumentation to SignalFire Cloud or a compatible private MQTT platform. RANGER devices communicate over LTE-M or NB-IoT cellular networks.

Unlike an industrial device that accepts unsolicited connections through a publicly exposed port, the RANGER initiates its own outbound connection to a configured MQTT broker. It does not accept direct inbound connections from the public internet.

The process works as follows:

1. The RANGER collects information from connected sensors or instrumentation.
2. It initiates an outbound connection to the configured MQTT broker.
3. Through this established connection, the RANGER publishes process data and subscribes to authorized topics for permitted commands or configuration changes.
4. The broker routes messages between the RANGER and SignalFire Cloud or another authorized destination.

As a result, SignalFire Cloud communicates with the RANGER through the established MQTT broker connection rather than through a direct public connection to the device.

Adding Encryption Beyond the Cellular Connection

Cellular networks use standard encryption to protect communications between a device and the cellular network. However, cellular encryption alone does not automatically provide end-to-end protection from the field device to the final data destination.

That is why SignalFire uses TLS 1.2 to encrypt communications between the IIoT device and the MQTT broker. This additional encryption helps protect data as it travels through the communication path rather than relying solely on the cellular connection.

This layered approach helps provide:

• Authentication, confirming the identity of the communicating systems
• Confidentiality, helping prevent unauthorized parties from reading transmitted data
• Integrity, helping identify whether information has been altered during transmission

Protecting Data in the Cloud

SignalFire Cloud uses Amazon Web Services infrastructure rather than locally hosted SignalFire servers.

According to SignalFire’s IIoT cybersecurity architecture, stored data is protected using AES-256 encryption with encryption-key management, while transmitted data is protected using TLS encryption. This adds another layer of security after data reaches the cloud environment.

The complete communication path includes protections at multiple stages:

RANGER IIoT device → encrypted cellular communication → MQTT broker hosted through AWS infrastructure → SignalFire Cloud

No single security measure should be expected to protect an entire industrial system. Layered security helps reduce risk by protecting the device, the communication channel, the cloud infrastructure, and user access.

Controlling Who Can Access SignalFire Cloud

Protecting information in transit is only part of the cybersecurity equation. Organizations must also control who can view, manage, and modify their operational data.

SignalFire Cloud allows organizations to create individual user profiles and grant specific permissions based on each person’s responsibilities. Rather than providing every employee with the same level of access, administrators can limit users to the functions needed to perform their jobs.

SignalFire Cloud also supports two-factor or multi-factor authentication. Administrators can require it for all users, selected users, every login, or after a defined period of inactivity. Because the feature requires user configuration, SignalFire strongly encourages organizations to enable and enforce it for all applicable accounts.

Even when a password is compromised, two-factor authentication can provide an additional barrier by requiring a second form of verification.

Cybersecurity Requires Shared Responsibility

Technology can provide important safeguards, but cybersecurity must remain a shared responsibility across operations, engineering, IT, management, and equipment providers.

Organizations should regularly review:

• Which industrial devices are connected to the internet
• Whether any unnecessary inbound ports are open
• Whether firewalls restrict traffic to trusted sources
• Whether default credentials have been replaced
• Whether users have only the permissions they need
• Whether two-factor authentication is consistently enforced
• Whether employees know how to report suspicious activity

Understanding the complete communication path, from the field device to the cloud, is an essential first step toward reducing risk.

Secure Remote Monitoring with SignalFire

Remote visibility does not have to require exposing industrial equipment directly to the public internet.

SignalFire’s RANGER IIoT architecture combines encrypted cellular communication, outbound MQTT publishing, TLS encryption, cloud-based data protection, user permissions, and optional two-factor authentication to help organizations securely monitor critical process information.

Is your IIoT infrastructure protected?

Contact SignalFire to discuss secure wireless sensing, monitoring, and telemetry solutions for your operation.