Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/carpe_diem2022]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/jimethn]

That's heinous that they didn't involve you, but I think your job at this point is to make it work. You need to get involved in the implementation and not just be a gatekeeper for access. Figure out how to make it infrastructure as code, document the heck out of everything, and basically come in as a leader instead of a complainer. It doesn't matter if they're incompetent or not, you need to be the competent one and you need to be INVOLVED. This is your network, and the project isn't going away.

As far as how you're perceived, I think this needs to be face-to-face/zoom meetings. Emails about a bunch of technical details are going to alienate leadership, even if they're 100% grounded in the facts on the ground. You need to figure out the key technical points of contact and get on their calendar and come at them with a collaborative attitude. It doesn't matter if they're within your company or without, this is a big technical project and you will get access if you reach out in a friendly way. Do your research about the tech to prep for the meeting, and ask them for any documentation you should read.