01 The Plant Has More Than One Network

The plant has wires. The operation also has air.

Walk through any modern energy site and you will find the network everyone knows. Cables run from the control room to the controllers that open valves, spin turbines and pump water. A firewall guards the edge. The security team has a map of it.

Now open a few cabinets.

Inside one, a small cellular router with a SIM card blinks quietly. A vendor put it there so they could check the equipment without driving out. Inside another, a field controller reports to the grid operator over a mobile link. At the wind farm down the road, every turbine phones home the same way.

None of that traffic crosses the plant's firewall. It travels through the air, through a mobile carrier, to wherever it was set up to go.

What a private APN is, in plain words. An APN, or access point name, is the door a SIM card uses to get onto a mobile data network. A public APN leads to the internet. A private APN leads to a closed network that a carrier sets aside for one organization, often the local grid operator. Operators use it to read and control equipment spread across many sites.

It sounds like a private line. In practice, it can work more like a shared hallway. Every site with a SIM on that APN is a neighbor. If the hallway lets neighbors knock on each other's doors, one broken lock anywhere puts every door at risk.

Why it stays off the map. The plant often does not own this network. The grid operator does, or a vendor, or a carrier. So it rarely shows up in the plant's own security review. Nobody is careless. The road simply belongs to someone else.

That is the second network. The rest of this book is about what happened when someone used it.