Every year, more equipment on construction sites and energy facilities ships with an Ethernet port, a cellular modem, or a cloud dashboard. Pump skids, compressors, generators, tower crane monitors, gate controllers and tank gauges all want to be "connected." The convenience is real: remote monitoring, fewer truck rolls, better data. But each connection is also a new path into something that moves fluid, spins metal or switches power.
The decision to connect a device is often made by an operations manager or a vendor technician, not by IT. That is exactly why a short, repeatable set of questions helps. Ask them before the cable goes in, not after the first strange alarm.
The seven questions
1. What does this device control, and what is the worst realistic outcome if someone else controls it?
Be specific. A thermostat on a trailer is not a wellhead shutdown valve. Rank the device by consequence: safety, environmental release, downtime, or nuisance. The higher the consequence, the more scrutiny the connection deserves.
2. Does it actually need to be on a network?
Sometimes the honest answer is no. If the only benefit is a nicer screen in the office, a local display or a periodic manual reading may be safer. If the answer is yes, write down who needs the data and how often.
3. How will it connect, and who owns that connection?
Vendor-supplied cellular modems are a common blind spot. They bypass your firewall entirely and may be managed by a third party you have never met. Find out whether the device uses your network, a vendor modem, or both, and who can log in.
4. What are the default credentials, and can they be changed?
Many industrial devices ship with a well-known default username and password. CISA has repeatedly warned about internet-exposed control devices with default or weak credentials. Change them at commissioning, store the new ones in a password manager, and be wary of equipment where credentials cannot be changed without a documented compensating control.
5. Is it reachable from the internet, directly or indirectly?
Direct exposure, such as a port forwarded through a router, is the worst case. Indirect exposure happens when the device sits on the same flat network as laptops that browse the web and open email. Ask where the device lives in relation to office computers, guest Wi-Fi and cameras.
6. How will it be updated and supported?
Ask the vendor how security fixes are delivered, how long the product will be supported, and what happens if a flaw is found. A device with no update path needs stronger isolation around it.
7. What happens when the connection fails or is attacked?
Confirm the equipment still operates safely if the network drops, and that manual control remains available. Network loss should degrade monitoring, not safety.
Turning the questions into a simple process
You do not need a committee. A one-page intake form can capture the answers. One person, such as the operations lead, can sign off, with IT or your managed provider reviewing the network side.
- Record the device, location, vendor and purpose.
- Record how it connects and who has remote access.
- Assign it to a network segment separate from office computers.
- Change default credentials and record where the new ones are stored.
- Note the vendor support contact and the manual fallback procedure.
Keep the completed forms. They become the seed of an asset inventory, which is the foundation of every later OT security step, including incident response and any compliance work.
Common mistakes to avoid
- Letting a vendor technician plug in a cellular gateway "just for commissioning" and leaving it permanently.
- Putting controllers on the same Wi-Fi as office staff and guests.
- Sharing one remote-access account among several vendors and employees.
- Assuming a device is safe because it is "too obscure to be targeted." Automated scanners do not care how obscure it is.
Where Ironfield Cyber fits
Ironfield Cyber helps construction and energy companies review how equipment connects, separate OT devices from office networks, and write the intake process above in a form field teams will actually use. If you have equipment already connected and are not sure how, a short network walkthrough is a good place to start.