A security boundary protected old manuals while the real work grew eight times larger outside
One employee’s account describes a company whose unofficial development network became the essential one.
The protected core ended up holding old product documentation. The engineers, testing systems and useful internal services were somewhere else.
That is the situation described by submitter Chops in Securely Useless, published by Ellis Morning. The account says a company brought in outside IT to pursue UK Cyber Essentials compliance, then made ordinary software development difficult through its implementation of restrictions.
Developers could not easily run needed tools, connect between networks or attach the company’s own products for tests. Unofficial PCs appeared. Tunnels followed, along with addresses passed around on paper because DNS approval was unavailable.
Management eventually permitted a second, less secure network with one bridge to the protected side. The story’s punch line is a sizing claim: that second environment was “about eight times the size” and held essential activity. The formally protected heart of the business held a decade of outdated, unsearchable documentation.
This is one submitter’s story, carried by the outlet that published it. The company is unnamed, its inventory is unavailable, and the account is not an audit of Cyber Essentials or proof that the standard requires those restrictions.
The uncomfortable follow-up is what the company would call its core during an outage. The answer from the people restoring service might differ from the one on the certification diagram.