Definition
SCADA (Supervisory Control and Data Acquisition) systems are responsible for functions such as field telemetry, remote signaling, remote control, and remote adjustment, and are central to energy, water, manufacturing, and infrastructure sectors. As stations become more dispersed and the proportion of unattended sites rises, remote operation and maintenance require access to historical data, alarms, and reports via cellular or hybrid links. IoT SIM cards provide wide-area access for RTUs/gateways, but if there is a lack of isolation from the control plane, they may introduce risks such as scanning, brute-force attacks, and lateral penetration.
'IoT SIM isolation' emphasizes defining boundaries on both the carrier and enterprise sides: on the SIM side, use independent APNs/private networks and directional routing; on the platform side, adopt DMZs, bastion hosts, zero-trust access, and least privilege to ensure remote sessions cannot directly reach unauthorized control network segments. Telemetry and remote control should be layered: highly sensitive control should remain locally or within a VPN, while the cloud mainly handles read-only access and alarms.
Technical Features
SCADA protocols are diverse (Modbus, IEC 104, DNP3, OPC, etc.), and gateways often perform protocol conversion and caching. Cellular links may experience jitter, disconnections, and DNS anomalies, requiring offline caching, time synchronization, and security certificate rotation on the gateway. For long-connection scenarios, NAT timeout, carrier heartbeat policies, and the SIM data plan's 'long-connection friendliness' should be evaluated.
From a security perspective, it is recommended to layer bidirectional TLS, device certificates, IP whitelisting, and operation auditing; in cases of SIM theft or terminal loss, processes for remote shutdown, certificate revocation, and tunnel key replacement are needed. SimtoLink can help align SIM policies (directional, rate-limited, regional) with platform-side zero-trust policies to form a closed loop.
Use Cases
Distributed pump stations, photovoltaic combiner boxes, environmental monitoring stations, and auxiliary monitoring for small substations are often built using SCADA substations + cellular cloud solutions. These sites are numerous and geographically dispersed, making traditional dedicated lines costly, whereas cellular networks are more flexible. Through zoned isolation, visualizations and reports can be provided to the dispatch center without compromising the security of the main control.
During the launch phase, penetration testing and emergency drill exercises should be completed, specifying remote maintenance windows, dual-person authorization, and change records. For critical infrastructure sectors, compliance with industry regulations for log retention, MLPS (Multi-Level Protection Scheme) assessment, and supply chain security is also required.
Deployment and Operation Recommendations
During the project implementation phase, enterprises should bind the IoT SIM card numbers to device serial numbers, installation locations, power supply methods, and maintenance responsible persons one-to-one, and sync this information into the asset and operation system to form a traceable link from card issuance, modification, activation, suspension to eventual cancellation. For equipment involving cross-province allocation or cross-border delivery, roaming charges, real-name registration policies, and local data compliance requirements should be evaluated in advance. It is recommended to choose solutions with predictable costs that support remote network switching or eUICC, reducing the frequency of on-site disassembly, and reserving spare cards and emergency replacement processes to shorten fault recovery time. For terminals received in bulk, it is recommended to perform sampling network verification covering connectivity and charges before activating the entire batch, to reduce rework costs.
In terms of cybersecurity, it is recommended to configure dedicated APN or VPDN tunnels for production or critical infrastructure terminals, converge north-south traffic to enterprise-controllable boundaries, and link with identity authentication, bastion host remote maintenance, and operation auditing; for remote control and parameter writing capabilities, hierarchical authorization, time windows, and dual-person review should be set. Regular drills for weak network and primary/backup link switching should be organized, recording latency, packet loss, and recovery time as technical references for MLPS (Multi-Level Protection Scheme) assessment, industry regulatory inspections, or internal risk control reviews. For third-party outsourced operations, minimum permissions, session recording, and key custody responsibilities should be clarified to avoid account sharing.
In daily operations, card management platforms should be used to continuously track online rates, abnormal traffic, dormant terminals, and data plan utilization, integrating alarms with the ITSM work order system to achieve automatic ticket assignment and closure. SimtoLink can split data pools for enterprises by factory, line, or business domain, providing bulk device suspension/resumption, API integration, and billing allocation capabilities, supporting visibility, control, and sustainable cost reduction at large-scale points, while aligning card management insights with project budgets and cost centers to improve transparency.