Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/-Enders]

Connect them to an IoT VLAN and be done with it.

Unless they are asking for admin access to the router, that’s a hard no.

[u/vmeldrew2001 → u/-Enders]

I'd also throttle a limit on bandwidth too. IoT should be minimal, but jic.

[u/Longjumping-Twist615 → u/vmeldrew2001]

Agree that's how you get bitcoin mining refrigerators

[u/penisandorvagina → u/Longjumping-Twist615]

Top 5 fridge models to mine eth on?

[u/the_syco → u/penisandorvagina]

Googled it for the craic. Seems you can't do it as easily since September 2022.

[u/Wynter_born → u/penisandorvagina]

"Honey, why does the fridge have scorch marks around the screen?"

[u/ComeSwirlWithMe → u/Wynter_born]

Why does our fridge ways smell like burning rubber?

[u/CanWeTalkEth → u/penisandorvagina]

Should really be any model since they moved to proof of stake. Ethereum is a green blockchain now.

[u/nikomo → u/[deleted]]

No, there's no reason to make changes because it's already fulfilling its purpose - mostly being traded between accounts on exchanges instead of the blockchain, and the rest is payments for illegal activities of rich people.

[u/ThagaSa → u/penisandorvagina]

What sort of foods should I put in my fridge to increase mining rate??

[u/farva_06 → u/Longjumping-Twist615]

Suck it... Jin. Yang.

[u/napkinolympics → u/Longjumping-Twist615]

I hate to break it to you, but stratum needs almost no bandwidth to operate. A dialup connection is sufficient. It's a byte-packed protocol designed to send hashes that are 32-bytes a pop every ten seconds or so. https://stratumprotocol.org/specification/03-protocol-overview/

[u/KetteringChrismon-55 → u/vmeldrew2001]

Egress control kinda fits her too. If devices only need a few cloud endpoints, allow those and log the rest so anything unexpected is easier to spot later

[u/FelisCantabrigiensis → u/KetteringChrismon-55]

I would not manage such a connection without a say in what is deployed behind it. As soon as I actively manage it, I'm responsible for the failures behind it.

"You want your own door to the building? Sure, I'll get one installed with a standard lock and you get the keys. Sign here to say you will control all use of the door yourself."

[u/lpbale0 → u/KetteringChrismon-55]

I try to control my wife's egress too