The last four devices to cause me a problem were a building management controller, a set of meeting room panels, a laboratory instrument and a bank of vehicle chargers in the car park. Not one of them was bought by IT, evaluated by IT, or budgeted by IT. All four are on our network, three of them hold credentials, and every one of them will eventually appear on a risk report with my name against it.
This is the direction of travel and I do not think it reverses. Facilities, operations, laboratories and manufacturing are all buying equipment that now ships with an interface, a cloud service and a vendor who would like remote access. The purchase is a capital project decision, made against a specification about airflow or throughput, and the technology attached to it is a footnote priced at nothing.
The mismatch that will define the work is lifespan. A chiller is a twenty year asset. The embedded computer controlling it is supported for five if you are fortunate, and the vendor's answer to a security question is frequently that the device should not be on a network at all, which it is, because that is how they sell the monitoring. We currently run three systems whose suppliers consider an unpatched operating system from a previous decade to be normal and supported. That is not a lapse; it is the industry's ordinary condition, and regulation is starting to arrive in exactly this space.
I do not think the answer is for IT to take over these purchases. We do not know enough about chillers. What I expect instead is that a technology review becomes a mandatory gate in capital projects, the way fire safety is, and that the questions become standard: what does it connect to, who can reach it remotely, how long is it supported, and what happens at end of support. Segmentation becomes the primary control, because patching often will not be available.
We have started asking suppliers for a supported lifetime in writing. Two could not provide one, which was itself the most useful answer we received.
The estate is quietly growing past the things that look like computers, and the inventory is the first thing to fall behind.
– Serguey Shinder
Top comments (0)