Who owns the connected equipment?

Imagine a hotel reviewing its cyber risks. The booking system has an owner. The finance team can identify who approves access to its software. Then someone asks about the refrigeration controllers in the kitchen. Facilities maintains the equipment, a contractor handles remote support, and IT looks after the network. Everyone has a reasonable answer about their part. Who can explain how the whole arrangement is secured?

In an alert first issued on October 12 and updated on October 16, France's CERT-FR reported compromises of remote refrigeration controllers. Its recommendations include removing public internet exposure, reviewing configurations, and restoring access through a protected network. The alert concerns specified equipment; it does not establish that a particular UAE business is affected. CERT-FR alert (external source, opens in a new tab)

The responsibility gap reaches beyond a particular product. A device can be essential to the business while sitting between the categories used to manage it. Its purchase belongs to a facilities budget. Its connection falls within a technical contract. Its failure becomes an operating problem. An exposed connection can survive several competent reviews if each stops at the edge of its own remit.

In the hotel, naming an owner would help only if that person could resolve the difficult decisions. Establishing which controllers are connected and who can reach them requires the contractor and IT. Changing access may require an operational decision. Assigning a name without that authority gives the question a recipient, but leaves the decision unresolved.

Turning off a connection can also interrupt a service the operator relies on. CERT-FR tells operators to check insurance-related contractual conditions before cutting data transmission to their refrigeration provider. That detail complicates a simple instruction to disconnect: operations and the supplier need to establish how the security change affects the service and its contractual requirements.

Where affected equipment is exposed or compromised, the operator and qualified support team should promptly follow the alert's guidance. An ownership discussion must not delay that response. The wider review can then trace a connection from the device, through its support contract, to the person who can authorize a change. For the hotel, the difficult case is a security restriction that interrupts something the kitchen relies on. The arrangement needs to work then, too.