We Will Spend the Next Decade Supporting Equipment We Did Not Choose
The last four devices to cause me a problem were a building management controller, a set of meeting room panels, a laboratory instrument and a bank of vehicle chargers in the car park. Not one of them was bought by IT, evaluated by IT, or budgeted by IT. All four are on our network, three of them hold credentials, and every one of them will eventually appear on a risk report with my name against…
The next decade will see organizations spending resources on equipment they did not select, according to Serguey Shinder. Four recent devices that caused issues were not procured, evaluated, or budgeted by IT. These devices, including a building management controller, meeting room panels, a laboratory instrument, and car park chargers, are now connected to the network and pose potential security risks.
Shinder believes this trend will not reverse, as facilities, operations, laboratories, and manufacturing departments are increasingly purchasing equipment with interfaces, cloud services, and vendors seeking remote access. The main issue is the mismatch between the lifespan of the equipment and the support provided by the technology vendor.
For instance, a chiller, a twenty-year asset, receives support for only five years. Suppliers often argue that certain devices should not be connected to the network, despite being integral to the system. Shinder suggests that a technology review should become a mandatory gate in capital projects, similar to fire safety requirements, and that questions should include device connectivity, remote access, support duration, and end-of-support procedures.
He emphasizes the importance of segmenting networks as a primary control, as patching may not always be possible. Shinder's organization has started requesting suppliers for a supported lifetime in writing, with two suppliers failing to provide one, which proved to be the most helpful response.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
