Wireless and Private 5G Security in OT: Connecting the Plant Floor Safely

01Key takeaways

1. 01

   OT wireless security treats the radio link as an untrusted conduit that must be authenticated, encrypted and segmented like any other zone boundary.

2. 02

   Private 5G non-public networks give plants control over their own SIM-based identity, slicing and spectrum, but they add a packet core and edge infrastructure that must be hardened too.

3. 03

   Wi-Fi 6/6E with WPA3-Enterprise and certificate-based 802.1X is the practical baseline for many plant-floor and IIoT deployments.

4. 04

   The biggest wireless risks are rogue access points, weak or shared credentials, flat radio segments that reach the control zone, and management planes exposed over the same air.

5. 05

   Wireless is well suited to publishing telemetry outward; where the use case is sensor-to-historian or device-to-cloud, a one-way transfer downstream of the radio removes the return path an attacker would need.

02What OT wireless and private 5G actually mean

OT wireless covers any radio link that carries operational data: industrial Wi-Fi, private cellular, and low-power protocols such as those used by sensor fleets. The point is to connect assets that move, that are hard to cable, or that are too numerous to wire individually. Mobile robots, AGVs, handheld HMIs, condition-monitoring sensors and remote field sites are the common drivers.

A private 5G network is what 3GPP calls a non-public network (NPN). It uses 5G radio and core technology, but the operator is the plant or enterprise, not a public carrier. The organization controls the spectrum (licensed, shared, or unlicensed depending on region), the SIM-based device identities, and the policies that govern who connects and what they can reach. Wi-Fi 6/6E, by contrast, uses unlicensed spectrum and a familiar access-point model, but modern versions add stronger encryption, better handling of dense device counts and improved deterministic behavior.

The short version: private 5G gives you carrier-grade identity and traffic control over your own spectrum; Wi-Fi 6/6E gives you flexible, low-cost coverage. Both are valid for OT. Neither is secure by default.

03Why wireless changes the OT threat model

OT environments are built around availability and safety. Systems run for years, patch windows are scarce, and an unexpected disruption can affect physical operations. Adding radio to that environment introduces a threat surface that does not respect physical boundaries: anyone within range of the signal is, in effect, plugged into the medium.

That matters because many OT protocols still assume a trusted network. Legacy fieldbus and even some industrial Ethernet traffic carry little or no authentication. If that traffic rides an open or weakly protected wireless segment, an attacker in the parking lot or an adjacent unit may reach assets that were never designed to defend themselves. MITRE ATT&CK for ICS documents techniques such as Wireless Compromise and Rogue Master that map directly onto poorly secured radio links.

• Coverage leaks beyond the physical perimeter, so the attack surface extends past the fence.
• Eavesdropping and replay are possible against unencrypted or weakly encrypted frames.
• Rogue access points and evil-twin networks lure devices into connecting to attacker-controlled infrastructure.
• Denial of service through radio jamming or association floods can stall time-sensitive control traffic.
• A flat wireless segment can become an unintended bridge from a guest or IIoT zone straight into the control zone.

04How private 5G and industrial Wi-Fi are built

A private 5G deployment has more moving parts than an access point on a wall. Devices carry a SIM or eSIM that holds a cryptographic identity. Radio units provide coverage. A packet core (often run on edge compute inside the plant) handles authentication, session management and policy. Network slicing and QoS let the operator separate, for example, a latency-sensitive control slice from a best-effort sensor slice.

An industrial Wi-Fi deployment centers on access points, a controller and a backend authentication service. The security depends heavily on configuration: which SSIDs exist, what authentication each uses, how clients are segmented after they associate, and whether the management plane is reachable over the air. Wi-Fi 6E adds the 6 GHz band, which reduces congestion and, because legacy devices cannot operate there, mandates WPA3, raising the baseline.

Radio access

Access points (Wi-Fi) or radio units (5G) that provide the air interface. The first point an attacker tries to reach or impersonate.

Identity and authentication

SIM/eSIM credentials in 5G; certificate-based 802.1X or WPA3-Enterprise in Wi-Fi. This decides who is allowed onto the network at all.

Core and policy

The 5G packet core or Wi-Fi controller that enforces sessions, slicing, QoS and which destinations a device may reach.

Backhaul and integration

The wired link from radio infrastructure into the OT zones. This is where segmentation and one-way enforcement are applied.

05Authentication and encryption: getting identity right

The first control is making sure only known devices ever associate. Shared pre-shared keys (the WPA2-Personal model) are a recurring weakness in OT because the key is rarely rotated and is often printed on a label or hard-coded into a fleet. One leaked key compromises the whole segment.

For Wi-Fi, the stronger pattern is WPA3-Enterprise with certificate-based 802.1X (EAP-TLS), so each device authenticates with its own credential and can be revoked individually. For private 5G, SIM-based mutual authentication is built into the standard: the device and the network prove identity to each other, and 5G adds protections such as encrypted subscriber identifiers to reduce tracking and IMSI-catcher style attacks. Either way, encryption of the radio link should be mandatory, not optional.

Treat the wireless credential like any other privileged secret. If a single shared key would let an attacker join your control segment, the wireless design has already failed.

06Segmentation: keeping the radio out of the control zone

Authentication decides who gets on the network. Segmentation decides where they can go once they are on it. This is where many OT wireless deployments quietly fail: a device authenticates correctly, but the wireless VLAN has a flat route into the control zone, so a compromised wireless client can reach a PLC or historian directly.

Map wireless segments to ISA/IEC 62443 zones and conduits. A wireless sensor network is a zone. The conduit from that zone into a control zone must be explicit, minimal and inspected. In a private 5G design, network slicing reinforces this: a sensor slice has no path to a control slice unless the core policy creates one. The default should be that wireless devices reach a defined collection point, not the process itself.

• Place each wireless use case (guest, IIoT sensors, mobile workers, robotics) in its own segment or slice.
• Terminate wireless traffic at a hardened gateway, not directly on control-zone switches.
• Use private addressing and deny-by-default conduits between the wireless zone and the control zone.
• Keep the wireless management plane on a separate, wired, out-of-band network never reachable over the air.
• Monitor for rogue access points and unexpected SSIDs as a continuous control, not a one-time survey.

07Where one-way transfer fits in a wireless design

Many wireless OT use cases are fundamentally about publishing data: condition-monitoring sensors stream vibration and temperature, mobile assets report position and status, remote sites send telemetry home. In these flows the data needs to leave the field, but the field rarely needs to receive commands back over the same path.

That is the natural home for one-way transfer. Once wireless telemetry is aggregated at a gateway, a data diode or unidirectional gateway can push it onward to a historian, analytics platform, SOC or cloud while removing the return route entirely. The radio segment stays isolated; the upstream data flow becomes provably publication-only. Even if a wireless client or the collection gateway were compromised, there is no network path from the enterprise or cloud side back through that conduit into the protected zone.

For teams designing sensor-to-cloud or plant-to-IT pipelines, an AIRGAPNET controlled connectivity pattern can sit downstream of the wireless aggregation point alongside segmentation and firewalling. The question to answer first is which wireless flows are genuinely two-way (for example, robot motion control) versus one-way (telemetry, alarms, status), because only the one-way flows are candidates for hard one-way enforcement.

08Standards and compliance mapping

OT wireless does not get its own rulebook; it inherits the existing OT security frameworks and adds wireless-specific guidance. The goal is to show that the radio link is treated as a controlled conduit with documented authentication, encryption, segmentation and monitoring.

NIST SP 800-82 Rev. 3

Guide to OT Security. Covers wireless considerations, segmentation and the principle of limiting reachability into control systems.

NIST SP 800-53 / SP 800-153

Control catalog and wireless LAN security guidance for authentication, encryption, rogue AP detection and configuration management.

ISA/IEC 62443

Zones-and-conduits model and security levels that wireless segments and their gateways should map to explicitly.

3GPP security (5G)

Defines mutual authentication, subscriber identity protection and the security architecture underpinning private 5G non-public networks.

Sector rules (NERC CIP, etc.)

Where applicable, electronic security perimeter and access-control requirements that any wireless conduit must satisfy and evidence.

09Common pitfalls in OT wireless deployments

Most wireless incidents in OT are not exotic radio attacks. They are configuration and architecture mistakes that turn a convenient link into an open door. Buyers and integrators should test against realistic failure modes, not the vendor demo.

• A single shared pre-shared key across an entire sensor fleet, never rotated, often documented in plain text.
• Wireless management interfaces (controller, packet core dashboard, AP admin) reachable over the production air interface.
• Default credentials left on access points, radio units or the 5G core after commissioning.
• A flat wireless VLAN that routes directly into the control zone with no inspected conduit.
• Coverage that spills well beyond the building, with no rogue-AP or jamming detection in place.
• Assuming private 5G is secure because it is cellular, while leaving the edge core and SIM provisioning unhardened.

CISA's secure-by-design guidance is a useful reminder: a wireless system is only as strong as its defaults, its management surface and the discipline of the team running it.

10OT wireless evaluation checklist

Evaluate a wireless or private 5G deployment as both a connectivity system and a security boundary. The radio is the easy part to demonstrate; the integration into OT is where the risk lives.

• How does each device authenticate, and can a single credential be revoked without re-keying the fleet?
• Is link encryption mandatory, and which algorithms and key lengths are enforced?
• Which OT zone does each wireless segment map to, and what is the exact conduit into the control zone?
• Is the management plane fully out-of-band and unreachable over the air?
• How are rogue access points, evil-twin networks and jamming detected and alerted?
• For private 5G, who hardens and patches the packet core, and where does it run?
• Which wireless flows are one-way, and can those be enforced with a diode or unidirectional gateway downstream?
• How does the design map to NIST SP 800-82, ISA/IEC 62443 zones and conduits, and any sector compliance obligations?

11Closing thought

Wireless and private 5G are not inherently risky for OT. They are powerful when the radio is treated as exactly what it is: an untrusted medium that must be authenticated, encrypted, segmented and monitored before it touches the process.

Start from the data flow, not the antenna. Decide which wireless conversations must be two-way and harden them as conduits, and identify the larger set of flows that only publish data outward. For those, the safest design is to let the radio gather the data and a one-way path carry it onward, so a convenient wireless link never becomes a route back into the plant.

FAQFrequently asked questions

SRCSources of record