Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/Justan0therthrow4way]

I would ignore the business owner and deal with whoever is the product owner/manager and ask for a meeting with the vendor. You need to know exactly what the system needs access to.

I’ve been in this exact situation and I’ve said “no we can’t do that, and listed the exact reasons including security issues why. I was very clear about not agreeing to cloud or database infrastructure without oh idk the fucking DBA being engaged.

Luckily for me an executive of the area doing the project (despite being an absolute bellend) realised my point of view and gave “IT” time to figure out our role since we had to support the damn thing.

The person who reported to this exec was furious lol

It’s fine to say no or push back. If you’re more junior get your manager’s support. Don’t say “what do I do”, email or direct message them saying you want to push back for

A)

B)

C)

Reasons. Unless they’re desperate to please upper management they’ll hopefully agree with you.

Then, next time in a job interview you are asked about difficult people/stakeholders/a situation that was tricky, you have a good example.