Poor remote access

Poor remote access: a vendor laptop with a shared stolen account and an unknown attacker both reach a single VPN concentrator with no user or device distinction, which opens a flat OT network of PLCs, HMIs, historian, SCADA and file servers, an engineering workstation and a printer, with the resulting risks listed.