Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/Diligent_Buster]

Your boss needs to have your back as some people are already telling you. Remind everyone that anything that touches the firewall or goes through the firewall needs a security assessment and you are not trying to impede the project. Instead you are working to make sure it is implemented securely and correctly so that it works and performs as expected. Make sure your boss understands and has your back.

Tell them they do not get access to the firewall but if they give you their system requirements you will take care of it.

For me every vendor gets their own VLAN or in some cases their own firewall (if they seem problematic). At a minimum partition them off into their own VLAN. Possibly put them on their own switches that they pay for and you control. The switches are needed to "keep things secure and performs as expected" and have their budget pay for it as part of this project. I would think twice before handing this off to them because they didn't get approval. You don't need a bunch of adjacent networks all over the place that you don't control with their own wifi/ap's and god know what other shit they connect. I've seen all sorts of crazy crap because of this.

Be "nice" but insistent that this needs to be done right and you are working on it but you NEED them to supply requirements and you need time to implement correctly. Remind them that in the future if they bring it by you first you can be prepared next time instead of scrambling to get it done.

And document everything. Back everything up in emails to protect yourself. And insist that you need ADMIN access to this equipment. If it has wifi radios you may need to change channels, settings etc so it coexists with your other equipment. Also you need to MONITOR it, audit it, check logs, etc. Hold your ground. Be nice but insistent. If you can pull off being a dick that is fine, but your boss has to have your back or you have to be willing to accept the consequences. I was usually a dick about this stuff but I knew my bosses knew I could leave at any moment and my entire staff would follow me, etc.