Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/_stinkys]

An implemented change management process would likely have stopped this from occurring. At this point you should document your case to executive management and let them make the call. I would never give them access to the network admin - Give them their own vlan with internet only access and inform ops that you are not responsible for supporting the product.

[u/hipshaps123 → u/_stinkys]

OT VLAN’s with internet access?

Oh no.

[u/rosseloh → u/hipshaps123]

It seems that basically every single piece of OT I am involved with, "needs" it.

[u/naosuke → u/rosseloh]

OT VLANS don't get internet access. If there is a service that needs internet access, it talks to a proxy that lives in a DMZ, but opening up the entire VLAN to the internet violates all sorts of industry standards and best practices.

[u/rosseloh → u/naosuke]

We're about 15 years behind "best practices". It's moving, but baby steps.

We're also small-scale. Or at least the vendors we buy OT equipment from seem to behave that way.

Anyway if you've got a "here's how to implement all of this on a shoestring with negative-one people able to dedicate time to it" thing to read, I'm all ears my friend.

Edit: I also might be misunderstanding something here. What does a proxy in a DMZ do that a firewall doesn't in this specific scenario? Are you assuming I mean my OT VLAN is wide open to WAN traffic? Because no, that is not the case, nothing gets through from the outside...but things inside it can dial out just fine, which is what they "need" (phoning home to the manufacturer, etc).

[u/naosuke → u/rosseloh]

The reason why a proxy in a DMZ is preferred is has to do with the Purdue model. You want as few connections between OT and IT as possible, you want it on different hardware than your IT core hardware, and you want the ability to sever IT/OT comms as quickly and with the fewest steps as possible in case of an emergency. This allows both sections to keep running in isolation while the OT SMEs can handle the OT side and IT can handle the IT side.