The jobsite trailer network: securing temporary sites, cameras, and shared laptops without slowing the crew
The trailer is a branch office that moves every year
Most contractors put real thought into the main office network. The jobsite trailer gets whatever shows up the week mobilization starts: a cellular router out of a box, a camera system the security company installed, a printer, a couple of laptops everyone shares, and a Wi-Fi password written on the whiteboard.
That trailer still runs real business. Drawings, RFIs, submittals, daily reports, timecards, pay applications, and sometimes payment approvals all pass through it. If it goes down, the crew loses time. If someone gets into it, they may get a path into your project software, your email, or the office network.
The goal is not to make the trailer as locked down as a bank. It is to make it standard, so every site goes up the same way, works on day one, and comes down cleanly when the job closes. This post walks through that lifecycle. If you want the deeper network side, our earlier post on carving flat OT and IT networks covers segmentation in more detail.
Why temporary sites drift
Jobsites are hard for reasons that have nothing to do with anyone being careless:
- Every site is set up under schedule pressure. The superintendent needs internet now, not after IT gets a ticket in.
- Gear comes from different places. The GC, the owner, the security vendor, and the internet provider may each drop off a box.
- People rotate. Subs, inspectors, owner's reps, and new hires come and go, and the shared Wi-Fi password usually stays the same.
- Nobody owns close-out. When the job ends, the trailer is hauled away and the gear goes into a storage unit with the old settings and accounts still on it.
The result is that each site ends up a little different, and the differences are where problems hide.
Start with a standard trailer kit
The single most useful thing a contractor can do is decide what a trailer gets before the next job starts, and keep it the same every time. A reasonable kit looks like this:
- A managed firewall or router that IT can see and update remotely, not a consumer box nobody can log into later
- A managed switch so cameras, printers, and laptops are not all plugged into the same flat network
- Separate wireless networks for company devices and for guests and subs, with the guest network kept off company systems entirely
- A documented internet plan, whether that is cellular, a fixed wireless link, or a wired circuit, with a backup if the site depends on it
- A one-page site sheet taped inside the network cabinet: what is installed, who supports it, and the number to call
When the kit is the same at every site, setup is faster, support is easier, and you can actually tell when something is out of place. A good test: could someone who has never been to this trailer figure out what is plugged in and who to call in five minutes?
Cameras and site gear: who owns them?
Site cameras, access control, and environmental sensors are often installed and monitored by a third party. That is fine, but it raises questions that should have answers before the gear goes up:
- Is it on your network or its own? Cameras on their own cellular link or their own isolated segment are much easier to live with than cameras on the same network as the superintendent's laptop.
- Who has the admin password, and was the default changed? Temporary gear is notorious for shipping with default logins that never get touched.
- How does the vendor connect remotely? If they have a remote access path into the site, it belongs on your vendor access list, with a named owner on your side.
- Who updates it? If the answer is nobody, plan for that before it becomes a problem.
None of this requires buying anything new. It requires asking the questions at kickoff instead of after something goes wrong.
Shared laptops and tablets
The shared trailer laptop is one of the most common weak spots in construction IT. It is logged in as one generic account, it has the project software open all day, and anyone who walks in can use it.
A few practical changes go a long way:
- Give people their own sign-in, even on shared devices. Named accounts with MFA mean you know who did what, and you can turn off one person without changing a password for the whole crew.
- Manage the devices centrally. Field laptops and tablets should get the same updates, endpoint protection, and disk encryption as office machines, and IT should be able to see them from anywhere.
- Plan for loss. Tablets get left on tailgates and laptops get stolen out of trucks. If a device can be locked or wiped remotely and the data on it is encrypted, a lost device is an inconvenience instead of an incident.
- Keep files in the project system, not on the desktop. When drawings and photos live in the shared project platform, a dead laptop does not take the job's records with it.
The technology is usually the easy part here. The harder part is getting field leadership to treat a shared tablet like a company asset instead of a jobsite tool.
Guests, subs, and inspectors
Every trailer has people who need internet and are not your employees. The clean answer is a guest network that gets them online and nothing else: no access to printers, cameras, shared folders, or company laptops.
Two habits help:
- Change the guest password on a schedule, and at least when the job changes phases or a sub demobilizes.
- Test it. Plug a personal device into the guest network and try to reach the printer, the camera recorder, and a company laptop. If you can see them, so can everyone else on that network. Separate network names are not enough on their own if the traffic underneath is not actually separated.
Payment approvals do not belong on a trailer whiteboard
Jobsites are where a lot of change orders, pay apps, and vendor questions get discussed, which makes them a natural target for payment fraud. If someone in the field approves invoices or relays bank changes to the office, that process should follow the same callback and verification rules as the office. We covered how that fraud usually works in our post on fake bank change requests.
Close-out is part of the job
Most of the risk from temporary sites shows up after the job is over. The trailer leaves, but the accounts, passwords, and remote access paths stay behind. Build a short close-out checklist into the project close-out you already do:
- Disable guest networks and change or remove any site-specific passwords.
- Remove or reset vendor remote access tied to the site.
- Collect shared devices, confirm they are still managed, and check that files made it into the project system.
- Factory reset or re-image gear before it goes into storage, so the next site starts clean.
- Cancel or move the internet service so you are not paying for, or exposing, a circuit at an empty lot.
- Update the asset list so the gear shows as back in inventory.
If this lives in the same close-out packet as punch lists and lien waivers, it actually gets done.
Where to start this month
You do not need to fix every site at once. Pick the next job that is about to mobilize and set it up with a standard kit, named sign-ins on shared devices, and a tested guest network. Then use that site as the template for the rest.
If you want a quick outside look at how your office and field setup line up, our IT Health Check is a good starting point. You can also read how we approach IT for construction companies and what managed IT covers day to day. If you would rather talk it through, book a time with us.
Jobsites are always going to be temporary. The way you set them up does not have to be.