Accessing this client's system is a convoluted process, and parts of their infrastructure are unreliable.

The original intent of this setup was that there would be layers of access to prevent people allowed to access one machine from gaining access to another, and that third party suppliers would do everything over an encrypted VPN.

It was put together for them by a third party supplier (not us).

To access the system we have to go through multiple layers of security, all of which are unergonomic and cause most people to cut corners (for example, to get into the system, you have to remember 6 passwords, which expire weekly. Most people have a sheet of paper with all their passwords on it.)

The sytem is accessed through an encrypted VPN but getting a login takes 3 months, so people share logins.

Further to that, maintainence is difficult because there is no guarantee, at the point when a breach occurs, that we will be able to get in - anything not working will prevent us accessing anything deeper down.

How would one go about simplifying this, while preserving the original intent of the system?

closed as off-topic by Vietnhi Phuvan, gburton, gnat, keshlam, Joe Strazzere Dec 19 '16 at 1:11

  • This question does not appear to be about the workplace within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 7. Who appointed you to decide what the client's security setup should look like? Do you have any idea what security issues the client was trying to solve or manage, and in what order of priority? 8. Have you even talked to the client about any of your plans, or is the client supposed to be the last one to know? – Vietnhi Phuvan Dec 18 '16 at 20:19
  • 2
    This seems more like an issue for security.stackexchange.com – Philipp Dec 18 '16 at 20:24
  • @Philipp - you're right. Voting t close for the reason you cite. – Vietnhi Phuvan Dec 18 '16 at 20:32
  • 2
    I'm voting to close this question as off-topic because it does not belong on this site. – Vietnhi Phuvan Dec 18 '16 at 20:36
  • 2
    I'm voting to close this question as off-topic because others have suggested I move it to security.stackexchange and I agree – gburton Dec 18 '16 at 20:37

OK sounds like a bad design. A new security design is not a Workplace question. How to simplify is not your task (as I understand the question).

If it is your task to re-design the security then I suggest SO Security.

Communicate the impact to your company

  • Time to login
  • Must enter / remember multiple passwords
  • Unavailability
  • 3 months to get an account

Maybe don't share that you write passwords down and share logins.

Not the answer you're looking for? Browse other questions tagged or ask your own question.