Accessing this client's system is a convoluted process, and parts of their infrastructure are unreliable.
The original intent of this setup was that there would be layers of access to prevent people allowed to access one machine from gaining access to another, and that third party suppliers would do everything over an encrypted VPN.
It was put together for them by a third party supplier (not us).
To access the system we have to go through multiple layers of security, all of which are unergonomic and cause most people to cut corners (for example, to get into the system, you have to remember 6 passwords, which expire weekly. Most people have a sheet of paper with all their passwords on it.)
The sytem is accessed through an encrypted VPN but getting a login takes 3 months, so people share logins.
Further to that, maintainence is difficult because there is no guarantee, at the point when a breach occurs, that we will be able to get in - anything not working will prevent us accessing anything deeper down.
How would one go about simplifying this, while preserving the original intent of the system?