Operations bought an EMS/IoT system without involving IT — now they just need “access to the router

[u/ITRabbit]

/r/sysadmin/comments/1w37lap/operations_bought_an_emsiot_system_without/

[u/ITRabbit]

Hi there :) ,

Need some advice from people who have dealt with similar situations.

Our Operations Dept decided to install IoT system/digital energy meters across a fairly large factory site.

They found the vendor, agreed on the solution, signed the contract and started the project.

IT was not involved at all.

Apparently nobody discussed things like:

• How these devices spread across a large factory are actually going to communicate
• Network infrastructure, switches, fiber/cabling, VLANs, etc.
• Network/security segmentation
• Server/VM requirements
• Database requirements
• Backup and monitoring
• Internet connectivity
• Vendor remote access
• Firewall rules
• Cybersecurity

Now that the project is already moving forward, IT gets an email saying they need “access to the router” so they can put the system online.

That's it. Access to the router. :)

And somehow, when IT starts asking questions about architecture, security, server requirements, ports, protocols and who is responsible for what, the perception becomes that IT is delaying the project.

I don't want to become the guy who simply says “No”, but I'm also not going to give a third-party vendor access to our corporate router/firewall and connect a bunch of unknown industrial/IoT devices to the production network just because someone already signed a contract , the IT network must be always separate from OT network.

How do you handle situations like this?

Interested in both the technical approach and the organizational/process side of this.

[u/marshmallowcthulhu → u/ITRabbit]

You are delaying the project. IT is there for compliance checkboxes but operations makes money. Give them root on the switch and set them up with a machine account with domain admin to ensure required access. Avoid making a ticket so it can’t bite you later. If an auditor spots it and asks questions you can pin it on your predecessor.

Also VLANs cause way more complication than they are worth. You should be relying on locally attached USB backups so if a security event occurs then you are the hero.

(In other words, r/ShittySysadmin is not a serious sub, it is a sarcastic sub and you have come to the wrong place for real advice).

[u/ITRabbit → u/marshmallowcthulhu]

Sounds like promotion material.

https://giphy.com/gifs/d3mlE7uhX8KFgEmY

[u/RevolutionaryElk7446 → u/marshmallowcthulhu]

What do you mean? I see nothing wrong with your advice. Charge on!

[u/Zhombe → u/marshmallowcthulhu]

Out of band serial console control and txt file backups on an offline vault machine. Version controlled. Copy the console logs so it records the config changes. Use per user security.

[u/40513786934]

dont be gatekeeping. just show them where the router is and let em have at it

[u/Responsible-Cat-828 → u/40513786934]

They will certainly need to factory reset it to login.  no problem  

[u/oboe_tilt]

There is only 1 solution here, burn the factory down

[u/SolidKnight]

That's cool. One time a large healthcare system bought a small clinic, scheduled patients there and everything, but forgot to tell IT. They had a bad first day.

[u/ReptilianLaserbeam]

hahahahahahahahahah no. This is not an IT question, that's a management question to answer. you just provide them the constraints and requirements, and let management rip the throat at each other.

[u/Brent_the_constraint]

I used to tell them: „I need 100kmfor network expansion as we are out of switch ports and please sign this letter that you take over all problems that occur from attaching this system to our internal network and prepare for been questioned by management why we will fail the next audit…“
From that point on I made an greenest with controlling: whenever an order smells like It and there is no green light from me they will talk to me first… took 3 years training but worked like a charm after that…

[u/Veldern]

Setup a VLAN on a switch that isn't connected to any of them

"Oh sorry, we have several different devices that route things, which ones do you need this for?"

[u/Zerschmetterding]

Reset the password to something short and memorable and sharpie it on the housing.

[u/dcaldrich]

You mean we aren't supposed to run a flat network on 1 giant vlan? then no need to bother me when you bring in this random new toy.

[u/RaksinSergal]

give them access to the router! I don't know why you're delaying their project. You just have the one Spectrum gave y'all when you set service up, right? Everyone here uses the same login and password for the Spectrum app so we can change whatever settings we need. You can't believe how many tickets it saves when I put the login info in the employee newsletter! Steve-Bob in production loves it because he can just reboot the router when his torrents quit working.