Private 5G and LTE deployments in operational technology environments have moved from pilot to production across manufacturing, energy, transport, and logistics. The drivers are familiar: wireless coverage for areas where cabling is impractical, low latency for industrial robotics and time-sensitive control applications, and the capacity to handle large numbers of sensors and devices that traditional Wi-Fi struggles with at scale.
What most OT security programmes have not yet fully addressed is that private cellular represents a meaningfully different attack surface from the industrial Wi-Fi deployments it often replaces. Understanding those differences — and implementing appropriate hardening — is important before incidents occur.
Why Private Cellular Is Different From Industrial Wi-Fi
Industrial Wi-Fi (IEEE 802.11) security is well-understood by OT security teams. Enterprise WPA2/WPA3-Enterprise with 802.1X authentication, VLAN segmentation, and RF monitoring covers most of the important attack surface. Private cellular introduces components and trust relationships that don’t exist in Wi-Fi deployments.
A private 5G deployment has three key components that industrial Wi-Fi does not:
The Radio Access Network (RAN) in 5G consists of gNodeBs (gNBs) — the base stations. In private deployments these are typically small cells installed inside a facility. Unlike Wi-Fi access points, gNBs participate in a 3GPP authentication protocol and communicate with a centralised core network.
The 5G Core (5GC) is the control plane and user plane infrastructure. It includes the Access and Mobility Management Function (AMF), Session Management Function (SMF), and User Plane Function (UPF). In private deployments, the 5GC typically runs on-premises on industrial servers or edge hardware. This is OT-managed network infrastructure, unlike Wi-Fi where the “core” is simply a wireless LAN controller.
SIM/eSIM cards authenticate devices to the network at the cellular layer. This is a capability that Wi-Fi doesn’t have — devices require a provisioned SIM card or eSIM profile to connect. This creates a provisioning workflow and a supply chain that must be secured.
Key Attack Vectors in Industrial Cellular
Rogue base station (false gNB/eNB) attacks: An attacker with software-defined radio equipment can broadcast signals that appear to be a legitimate gNodeB. Devices that do not properly verify the network’s identity (or that the attacker can convince to downgrade to an older, less secure protocol) may connect to the rogue base station, allowing traffic interception or manipulation. In 4G LTE, mutual authentication is optional in some configurations. In 5G SA (Standalone), mutual authentication is mandatory — but many private deployments use 5G NSA (Non-Standalone) anchored to a 4G core, preserving the older vulnerability.
N2/S1 interface compromise: The interface between the gNodeB and the 5G Core (N2 in 5G SA, S1 in 4G/5G NSA) carries control plane traffic. If this interface is unencrypted or uses default credentials, an attacker with access to the transport network can intercept or inject control messages. In enterprise IT environments, these interfaces are typically on dedicated backhaul networks. In OT environments where the cellular infrastructure shares network segments with other industrial systems, this assumption must be explicitly verified.
SIM card and eSIM provisioning attacks: SIM provisioning requires access to the Home Subscriber Server (HSS in 4G) or Unified Data Management (UDM in 5G). An attacker who can write to these databases can provision rogue SIMs that authenticate to the network as legitimate devices — bypassing the SIM-based authentication that is otherwise a meaningful security advantage of cellular over Wi-Fi.
UPF placement and user plane interception: The User Plane Function routes data packets between connected devices and the OT network. In many private 5G deployments, the UPF is placed close to the core network to minimise latency. If the UPF is compromised or misconfigured, all traffic from cellular-connected OT devices passes through an attacker-controlled function.
IMSI harvesting: International Mobile Subscriber Identity (IMSI) values are unique device identifiers. In 4G and some NSA 5G configurations, the IMSI can be captured by an attacker operating a rogue base station. IMSI values can be used for tracking, and in some configurations, for subsequent attacks targeting specific devices.
Device-layer attacks via cellular connectivity: Cellular-connected sensors, PLCs, and field devices may receive over-the-air updates or remote configuration via the private cellular network. If update mechanisms are not secured with signature verification, an attacker who gains access to the cellular core could push malicious firmware to field devices.
Security Architecture for Industrial Cellular
Deploy 5G Standalone (SA) rather than NSA where possible: 5G SA provides mandatory mutual authentication between device and network, protecting against rogue base station attacks. NSA deployments inheriting 4G LTE control plane characteristics do not have this protection. Where NSA is required for coverage or device compatibility reasons, document this as a known risk and compensate with physical RF monitoring.
Segment the 5G core from OT control networks: The AMF, SMF, UPF, and associated management interfaces should be on a dedicated network segment with explicit firewall policy controlling traffic to and from OT systems. The UPF is the data plane boundary — traffic must pass through defined DMZ zones rather than directly between cellular devices and process control systems.
Encrypt N2/S1 backhaul: The transport between gNodeBs and the 5G core must be encrypted. IPSec tunnels between base stations and the core are standard for operator-grade deployments; private enterprise deployments sometimes skip this step when running on private MPLS or dedicated fibre. Both the confidentiality and integrity of N2/S1 traffic should be enforced regardless of the underlying transport.
Harden UDM/HSS with MFA and audit logging: The subscriber database is the key management system for the cellular network. Access to add, modify, or delete subscriber records must be restricted to authorised administrators and protected with multi-factor authentication. Every provisioning action should generate an audit log. Compromise of the subscriber database provides an attacker with the ability to create credentials for the cellular network.
Implement eSIM remote provisioning with cryptographic verification: eSIM profiles should be provisioned via the GSMA SGP.02/SGP.21 Remote SIM Provisioning standards, which include cryptographic verification of the provisioning server. Ad-hoc SIM provisioning processes without cryptographic binding to a known provisioning authority create a provisioning injection risk.
Deploy 5G-aware RF monitoring: RF monitoring for industrial cellular is different from Wi-Fi intrusion detection. Cellular RF monitoring tools look for rogue gNBs, unusual signal strength patterns, protocol downgrade attempts, and IMSI catcher signatures. Vendors with OT-specific 5G monitoring include Bastille Networks, Nozomi Networks (via cellular integration), and Claroty.
Apply zone-conduit isolation to cellular-connected devices: Cellular connectivity does not exempt devices from the zone-conduit model required by IEC 62443. A PLC that receives Modbus commands over a cellular path should be in a zone that permits only the specific protocols and commands it requires, regardless of the transport. The network path to a device does not change the security requirements for the device itself.
Vendor and Standards Resources
- GSMA TS.07: Security guidelines for private network deployments. The baseline document for private cellular security architecture.
- 3GPP TS 33.501: The 5G SA security architecture standard. Defines the security requirements that SA deployments must meet.
- NIST SP 800-187: Guide to LTE Security. Predates 5G but provides foundational guidance on LTE architecture and security considerations applicable to NSA deployments.
- CISA: Published guidance on cellular network security for critical infrastructure in 2025, covering both private deployments and dependencies on public cellular for OT remote access.
Private cellular is a legitimate architectural evolution for OT environments — it provides meaningful benefits for coverage, device density, and latency that Wi-Fi cannot match in many industrial settings. Those benefits come with a security architecture that is substantially more complex than Wi-Fi. Treating private cellular as “just another wireless network” is the mistake that creates exploitable gaps.