Fix actions
One change can close several proven paths. Verify runs a short retest of only the hosts on the original proof, then the paths that needed that weakness drop off the board.
Retire svc-backup
Remove the service account that can replicate the directory and read payroll. Domain Admin stays open through the breached password until that one is reset.
Breaks 2 open paths. That is 1 of 3 open critical paths.
Reset the breached Domain Admin
Rotate j.okonkwo and require phishing-resistant MFA. This is the second way into Domain Admin.
Breaks 1 open path. That is 1 of 3 open critical paths.
Revoke the deploy key
Delete the long-lived organization key in the build log and require IMDSv2 on the build host.
Breaks 1 open path. That is 1 of 3 open critical paths.
Patch the edge appliance and close WAN management
Upgrade past the affected PAN-OS build and take the management interface off the internet.
Breaks 1 open path. That is 0 of 3 open critical paths.
Cut the plant route and replace the HMI default
One segmentation change plus a password rotation stops the path from the engineering workstation to the cell.
Breaks 1 open path. That is 0 of 3 open critical paths.