If you are a regular reader of this site, you know that industrial/OT/ICS cybersecurity is a high priority amongst our writers. I have many articles on this site covering the importance of cybersecurity in industrial environments/infrastructures. This article is a continuation of that, focusing on some of the wireless technologies that are in active use in industrial environments.
Wireless has for decades been a focus for cybersecurity, because of the nature of wireless is that the traffic is unbounded by any physical barriers, making the traffic readable by malicious actors. Cryptography has been the solution for the wireless technologies we all know from the standard IT environments, but what about the wireless protocols in use in industrial environments?
Industrial Wireless Protocols
This section will list a subset of the wireless protocols in use in modern industrial environments, excluding the IEEE 802.11 technologies we know from IT, even though this is used in industrial environments, the focus here is on industrial wireless technologies.
|
Protocol |
OT/ICS Use |
|
WirelessHART |
Industrial process sensors, transmitters, condition monitoring |
|
ISA100.11a |
Industrial wireless sensor and control networks |
|
Zigbee / IEEE 802.15.4 |
Building automation, metering, sensors, lighting, environmental monitoring |
|
LoRaWAN |
Long-range, low-bandwidth remote sensors, utilities, environmental monitoring |
|
Wireless Modbus gateways |
Modbus RTU/TCP carried over radio, Wi-Fi, cellular, or serial radio links |
|
Wireless PROFIBUS / PROFINET bridge |
Vendor-specific wireless extensions for industrial Ethernet/fieldbus |
|
Wireless EtherNet/IP bridges |
Mobile equipment, AGVs, cranes, rotating machinery |
|
Wireless CAN / CANopen gateways |
Mobile machinery, vehicles, cranes, material handling |
There are many more than is listed above, some of them proprietary to specific vendors.Industrial wireless protocols are used in many scenarios, specifically when equipment, or people, are moving around a factory floor, or building site.
Wireless protocols are sensitive to interference from other equipment that radiate electromagnetic noise. Electromagnetic interference can be a security threat as well, if the interference is intentional. The focus of this article is on how to secure the communications of the industrial wireless protocols and not on any interference issues. Just keep in mind that many industrial environments are electromagnetically noisy, so interference might come from onsite equipment. Back to securing the communication of industrial wireless.
Securing Industrial Wireless Protocols
There are two ways of securing any industrial wireless protocols. A generic approach, seeing the protocols as a whole, and the more specific one, focusing on the individual protocol.
Personally, I am in favor of the generic approach, since this approach will secure wirelessprotocols across their individual use. That being said, there are cases where a site, or factory floor, are using a single wireless protocol, making the protocol specific security features viable. First off, the generic approach.
Generic Industrial wireless security
Apply an IEC 62443-style architecture: put wireless devices, gateways, engineering workstations, historians, and cloud bridges into security zones, and tightly control the conduits between them. Zones and conduits are a core IEC 62443 concept for segmenting industrial automation systems by risk and security requirements.
Most industrial wireless systems terminate at a gateway or border router. That device should sit in a controlled OT DMZ or dedicated zone, with firewalls, allowlists, and protocol inspection between wireless field devices and PLC/DCS/SCADA systems. Do not let wireless gateways provide broad Layer 2 reachability into the control network
Every device should have a unique identity and a controlled commissioning process. Avoid shared default join keys, vendor-default credentials, or “one key for the whole plant” designs. Disable unused commissioning modes after deployment.
Industrial wireless security often fails because keys are static, reused, copied into spreadsheets, or never rotated. Use unique per-device or per-link keys where the protocol supports them, rotate network/session/group keys, and revoke credentials when devices are replaced or lost
Encryption protects confidentiality; message integrity and authentication protect against spoofing and tampering. Replay protection matters because many OT messages are short, repetitive, and command-like.
The wireless gateway, network manager, security manager, join server, certificate authority, and provisioning laptop are usually more valuable attack targets than the sensors. Patch them, restrict admin access, use MFA where possible, disable unused services, back up configurations, and log admin actions
Wireless adds threats that wired OT does not expose as easily: rogue gateways, unauthorized joins, jamming, replay attempts, unusual routing changes, abnormal retries, and unexpected device movement. Monitor both cyber events and RF health
Industrial wireless security includes resilience. Use channel hopping, redundant gateways, antenna planning, coexistence studies, battery-health monitoring, and fallback operating modes. A jamming or interference event can become a safety or production issue even without data compromise.
For high-consequence control loops, wireless should usually be advisory, monitoring, or non-critical unless the full system has been engineered and certified for that use case. NIST’s OT guidance emphasizes securing OT while accounting for safety, reliability, and performance constraints.
A secure radio link does not make Modbus, DNP3, OPC UA, MQTT, or a vendor protocol safe by itself. Use application-layer authentication, authorization, signing, or TLS where appropriate, especially once traffic leaves the wireless mesh/gateway.
Protocol Specific Security
|
Protocol |
Native Focus |
Specifics |
||
|
WirelessHART |
AES-based security, authenticated joining, network/session/join keys |
Use unique join keys, protect the Network Manager/Security Manager, rotate keys, verify only authenticated messages are routed. FieldComm Group notes that WirelessHART uses join, network, and session keys for authentication and encryption. |
||
|
ISA100.11a |
|
Confirm which optional features are enabled, avoid weak provisioning, separate security-manager administration, rotate keys. ISA describes ISA100.11a as a secure wireless standard for industrial automation. |
||
|
Zigbee / 802.15.4-derived industrial systems |
AES-128 link-layer security, network keys, install codes depending on profile |
Avoid global default keys, use install-code or certificate-based joining where available, rotate network keys, restrict trust-center access |
||
|
LoRaWAN |
AES-128 keys, separation of network and application security |
Prefer OTAA over static ABP where possible, protect AppKey/root keys, separate network server from application trust, watch replay counters and gateway backhaul security. LoRaWAN security uses 128-bit keys and AES-128; LoRaWAN security material also describes CMAC for integrity and CTR for encryption. |
||
|
WPA2/WPA3 Enterprise, 802.1X, certificates, controller securit |
Avoid PSK for plant-wide networks, use EAP-TLS, isolate SSIDs/VLANs, detect rogue APs/evil twins, harden controllers, enforce client certificate validation |
The generic controls reduce systemic risk; the protocol-specific controls make sure you are using each technology’s security model correctly. The biggest mistake is assuming that because a protocol says “AES-128” or “secure by design,” the deployed system is secure. In industrial wireless, commissioning, key handling, gateway placement, and monitoring are often the difference between theoretical security and real security.
Many industrial wireless protocols might be tunneled inside of other protocols, like WI-FI, making the security of the protocols a multi layered challenge. The important takeaway from this article is, that wireless protocols radiate beyond the site where they are used, making securing them a critical cybersecurity measure!
Tom Madsen
Tom Madsen has been active in the cybersecurity industry for more than 20 years. Tom graduated from the University of Aalborg and covered several technical roles in security during his professional career. He is certified as CISSP, CISA, CISM, CGEIT, CRISK, CCSP, CDSPE and CSSLP, and has published the book “The Art of War for Cybersecurity”. He is currently writing a book ‘Security Architecture – How & Why’.
Leave a Reply