CISA says take your refrigeration controllers off the public internet. Here is how SIMSY does it.

Eliminate public internet exposure

The first recommendation is to stop exposing control system devices, and particularly their control panels, to the public internet. Where remote access is needed, CISA says it should sit behind an up to date firewall or edge device, and it points readers to its own Internet Exposure Reduction Guidance and Defend the Edge advice.

This is the most important step because every other item on the list assumes an attacker has to get past something first. Strong passwords and MFA only matter if the login page is reachable. Patching matters less if an unpatched device cannot be found. Allowlisting IP addresses is only meaningful if there is a boundary to enforce it at. Take the device off the internet and the attacker's starting point disappears.

It is also the step most often skipped, for an understandable reason. A refrigeration controller in a store or a cold store is usually installed and maintained by a contractor, not the retailer's IT team. The quickest way to give that contractor remote access is a cellular router with a public IP address and a port forward, or a vendor's cloud management portal that reaches the device over the open internet. Both work on day one. Both leave the device discoverable by anyone scanning for it, and that is exactly what the recent attacks relied on.

Devices off the public internet, by default

SIMSY is private by default. A device connected on a SIMSY SIM or eSIM is never given a public IP address and is never reachable from the open internet unless you deliberately configure it to be. That is not a feature you switch on. It is how the network is built.

Here is what that means for a refrigeration controller, a temperature logger or a site router in practice.

• Private addressing from the start. Every SIM sits in a private network on our mobile core, which we call a VSlice. You choose the IP range. Nothing in it is routable from the internet, so there is no address for a scanner to find.
• No port forwarding, no public management portal. Because the device has no public address, there is nothing to forward and nothing to lock down afterwards. We do not run or resell internet-hosted device management portals for the same reason: a portal on the public internet is the exposure CISA is telling you to remove.
• Routing policy you control. Traffic from each SIM goes only where you say it can go. A controller that only needs to talk to a monitoring server can be limited to exactly that, which covers CISA's allowlisting recommendation at the network layer rather than on each device.
• Segmentation without touching the store network. SIMs can be grouped and attached to different private networks, so refrigeration controllers can sit in their own network, separate from point of sale, Wi-Fi and the rest of the business. That is CISA's second recommendation, isolation from business networks, delivered by the connectivity itself.
• Works with the kit you already use. We supply and configure Teltonika and InHand routers and gateways, including models with multiple Ethernet ports, RS232, RS485 and Modbus, so a legacy controller with no cellular modem of its own can still be connected privately.

The result is that the controller is still remotely reachable by the people who need it, and invisible to everyone else.

Reach the device without opening it to the internet

CISA's advice does not say stop using remote access. It says put it behind something. The problem is that most operators and their refrigeration contractors do not want to run a firewall estate or a VPN concentrator for every site.

SIMSY Bridge is our answer to that. Bridge joins a SIMSY private network to your own secure network, built on WireGuard and Tailscale, so devices on SIMs appear as if they were on your LAN. Authorised engineers, including third party maintenance contractors, reach a controller through their normal identity and access controls, and the device never has to be opened to the internet to make that possible.

In practice:

• Engineers get full access to the device, including SSH and the command line, not just a web page.
• Access is granted per person and per device, so a contractor can reach the controllers they maintain and nothing else, and that access can be removed when the contract ends.
• Logging in needs the same strong authentication you already use for staff, including phishing-resistant MFA, which is CISA's third recommendation.
• We offer Bridge as a managed service from £15 per month covering unlimited SIMs, or you can run it yourself on regular SIM pricing.

The outcome is the one CISA is asking for: no public exposure, remote access that still works, and a single place to see who connected to what and when.

Every CISA recommendation, and where SIMSY helps

Step one is where SIMSY does the heavy lifting, but it is not the whole list. Here is each recommendation from the fact sheet and how a SIMSY deployment fits.

Ask one question first

If you run refrigeration or cold chain monitoring over cellular, the first question to ask is simple: can anyone on the internet reach the controller? If the answer is yes, or you are not sure, that is the thing to fix this week, before passwords, patches or anything else on the list.

Read the CISA fact sheet in full. Then talk to us about moving your devices onto a private SIMSY network and giving your engineers and contractors secure access through SIMSY Bridge.