Accessing this client's system is a convoluted process, and parts of their infrastructure are unreliable.

The original intent of this setup was that there would be layers of access to prevent people allowed to access one machine from gaining access to another, and that third party suppliers would do everything over an encrypted VPN.

It was put together for them by a third party supplier (not us).

To access the system we have to go through multiple layers of security, all of which are unergonomic and cause most people to cut corners (for example, to get into the system, you have to remember 6 passwords, which expire weekly. Most people have a sheet of paper with all their passwords on it.)

The sytem is accessed through an encrypted VPN but getting a login takes 3 months, so people share logins.

Further to that, maintainence is difficult because there is no guarantee, at the point when a breach occurs, that we will be able to get in - anything not working will prevent us accessing anything deeper down.

How would one go about simplifying this, while preserving the original intent of the system?

  • 7. Who appointed you to decide what the client's security setup should look like? Do you have any idea what security issues the client was trying to solve or manage, and in what order of priority? 8. Have you even talked to the client about any of your plans, or is the client supposed to be the last one to know? – Vietnhi Phuvan Dec 18 '16 at 20:19
  • 2
    This seems more like an issue for security.stackexchange.com – Philipp Dec 18 '16 at 20:24
  • @Philipp - you're right. Voting t close for the reason you cite. – Vietnhi Phuvan Dec 18 '16 at 20:32
  • 2
    I'm voting to close this question as off-topic because it does not belong on this site. – Vietnhi Phuvan Dec 18 '16 at 20:36
  • 2
    I'm voting to close this question as off-topic because others have suggested I move it to security.stackexchange and I agree – speciesUnknown Dec 18 '16 at 20:37

OK sounds like a bad design. A new security design is not a Workplace question. How to simplify is not your task (as I understand the question).

If it is your task to re-design the security then I suggest SO Security.

Communicate the impact to your company

  • Time to login
  • Must enter / remember multiple passwords
  • Unavailability
  • 3 months to get an account

Maybe don't share that you write passwords down and share logins.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged .