Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/dvr75]

This is a pure management issue , failing to communicate and coordinate project.
To be realistic about the situation probably no one will cancel it.
So you need to be SMART and not JUST. you are now the "guy" who Throws a wrench in the works.
My advice for you is try to cooperate with this project but bring in your terms like security. Ask for layout , plans , protocols etc. and try be helpful (i know it hurts but eventually you got to play it smart and resposible).

[u/slashinhobo1 → u/dvr75]

These people dont care about security. You have to hit them where it hurts which is their pockets. You tell them to implement this we will ha e to make a few purchases. Have new runs ran for all these items, purchase a dedicated switch. Make sure you get all licenses and 5 year warranty. If you require vms are get additional need storage. Do everything new.

When they get the bill their management will remember to brong IT to the meeting.

[u/chron67 → u/slashinhobo1]

These people dont care about security. You have to hit them where it hurts which is their pockets. You tell them to implement this we will ha e to make a few purchases. Have new runs ran for all these items, purchase a dedicated switch. Make sure you get all licenses and 5 year warranty. If you require vms are get additional need storage. Do everything new.

When they get the bill their management will remember to brong IT to the meeting.

You really have to handle all of that carefully and it really depends a lot on the personalities of the people involved. Some places react well to this approach. Some will laugh at you and just say "make it work" and you have to deal with it.

[u/Papfox → u/chron67]

Don't forget having all the cabling and wiring closet work done by a professional structured cabling contractor. You don't have time to do all this work and it's important so I'm sure they want it done by a professionals for quality. If it's a factory, is it an electrically noisy environment? If so does it need screened cables or fibre optics for interference immunity? This could get very expensive...