At first, the researchers were concerned that the software might be malware, although it did appear to be signed by Samsung itself. A call to Samsung technical support yielded the following response:When you enable Windows updates, it will install the Default Drivers for all the hardware no laptop which may or may not work. For example if there is USB 3.0 on laptop, the ports may not work with the installation of updates. So to prevent this, SW Update tool will prevent the Windows updates.Samsung has not replied to The Reg's request for comment but a Microsoft spokesperson emailed us the following statement:Windows Update remains a critical component of our security commitment to our customers. We do not recommend disabling or modifying Windows Update in any way as this could expose a customer to increased security risks. We are in contact with Samsung to address this issue.The case highlights the longstanding problem of OEM bloatware coming pre-installed on PCs. And while it isn't as egregious as the Lenovo Superfish debacle, it's still a serious issue. It's hard to see why Samsung thought disabling Windows Update was a good idea, given that Microsoft regularly uses it to push critical security fixes for all of its major products, but some bright spark obviously pushed the idea through.

On a more positive note, it is possible to buy some Samsung laptops without all the OEM crapware installed under the Microsoft Signature Edition brand. The downside is that you can only get them at the Microsoft Store; buy elsewhere and you're on your own. "It is not true that we are blocking a Windows 8.1 operating system update on our computers. As part of our commitment to consumer satisfaction, we are providing our users with the option to choose if and when they want to update the Windows software on their products," said Samsung."We take product security very seriously and we encourage any Samsung customer with product questions or concerns to contact us directly at 1-800-SAMSUNG."Despite my apparently youthful good looks, I've been in the IT industry since 1989. Which means I've been around the block a bit, and have learned rather a lot of lessons – some of them the hard way. To avoid you having to find them out yourself, here are ten to be going on with.Even in the brightest of data centres, the racks your kit lives in have more than their fair share of dark recesses. This makes reading the serial numbers or port marking off the back of devices more than a little challenging, and so a mandatory inclusion in your laptop bag is a little Maglite torch. And while you're at it a little dentist-style mirror on a stick wouldn't go amiss either. Oh, and if you're thinking of using the torch on your £650 iPhone: you'll change your mind when you've dropped it in the rack and scratched it to death.

If you have equipment delivered directly to your data centre, double-check how it gets its power and what cables come with it. I've had LAN switches delivered to US data centres with European-style plug on the cables, which was a pain in the butt. I've discovered the hard way that the Cisco 3750-X has a different power inlet from its predecessor (it's an IEC C16, not a C13) so when you upgrade you need new cables too. And the worst of all worlds is where you have a device that has a proprietary power brick – because they just don't fit standard rack power strips. All of these things are surmountable, but don't wait to find out until you get to the data centre and you can't install anything.If your network's died, or the server's gone pear-shaped, you'll need your diagrams and reference sheets. And it's no good if they're sitting on the fileserver that just turned up its toes. Keep an up-to-date copy of the documents somewhere that you know you'll be able to get at it: on your laptop, or maybe on a Cloud repository like Google Drive. If your docs repository is SharePoint based then SharePoint Workspace lets you keep a synced copy on your PC.

Neat cabling looks fab. It also makes it a breeze to trace cables, to install new stuff, and most importantly to get old stuff out. If your racks are a rats' nest of cables then the chances are you won't be able to pull out unwanted cabling – so it'll just sit there with the ends dangling in the breeze and generally getting in the way. Take your time to make cabling neat, and use cable management attachments in the racks to help you.My dad was an engineer, and he taught me a lesson that I use at least once a week: if someone tells you they have a problem, see for yourself before believing them. “The printer's faulty” could mean that the printer's faulty – but it could equally mean that the spooler has crashed, or they've done something daft to their driver, or even that they've knocked the LAN cable out of their PC so it can't see anything on the network (including the printer). You're the IT person, so you probably know best.

If you care about your servers staying accessible, double-connect them to the network. If they support it then team the network adaptors with LACP/EtherChannel, but if not then use the teaming software that comes with the adaptors to run the ports as a team in active/passive mode. Oh, and have two NICs (there's no point double-connecting stuff in a dual-port NIC because if the NIC dies, the server's off the network) and connect them into two switches.Change control is an absolute must. Have a log of changes, and be rigorous about updating it. If people don't update it, be firm with them (make it a disciplinary offence – it's truly that serious). What's the first thing you ask when a problem is reported? “Has anything changed?”. You need to be confident of the answer your documentation gives you.Be as cautious about the hundredth time you do something as you were about the first. Familiarity leads to complacency, and it's easy to assume that just because something has always worked as expected it'll continue to do so. So your Web site code drop has never failed … until you renamed the old version and ran out of disk space whilst copying the new one over. Or maybe you've never done the task on 1 March in a leap year before. Don't be paranoid about it, of course – but don't be blasé either.

It's surprisingly common to carry out two apparently unrelated changes only to discover that there's a relationship between them after all. And you usually find this out when something goes wrong. Most common is where you have two changes and both of them experience unrelated problems that need the on-call engineer to have a shufti, and all of a sudden you're Googling for the phone number of the Shit Creek paddle shop as two teams depend on one person. Consider the dependencies of activities whether they go well or badly.You can have a contractual relationship with your vendors, and you need to be professional when dealing with them, but there's no harm keeping on the right side of the techies you deal with day-to-day. So when I had a two-hour-response SLA on my phone system and something non-fatal threw an alert at going-home time, I'd often say to them: “No worries, come at 9am tomorrow”. And when they were in doing upgrades I'd provide the coffee and pizza. The amount of free advice and ad-hoc consultancy I got in return was amazing.

Your users are probably using cloud-based services that you’re not even aware of to organise their files and collaborate with each other. What are you going to do about it?“Shadow” IT — cloud services bought from third-party providers without authorisation by the IT department — is becoming a significant problem for many companies, even if they don’t know it yet.Canopy, the Atos cloud brand, recently conducted a survey of 350 IT decision makers across the UK, Germany, France, the Netherlands and the US. Half of the line of business managers reckoned between five and 15 per cent of their departmental budget was spent on shadow IT, amounting to €8.6m.And 60 per cent of the CIOs surveyed said that shadow IT drained around $13m on average from their organisation last year.Bleeding budget as customers flock to third-party service providers is a problem enough in itself, but security is just as big an issue. According to the Canopy survey, the lion’s share of the cash went on backup services, meaning that files are being sent to service providers over which the IT department has no control.Companies often only refresh their IT in a major way every decade or so, according to Thales Security cybersecurity practice lead Sam Kirby-French.

In contrast, employees’ experience with technology outside the office evolves continually, and they are constantly presented with new and exciting technology options that can make office systems look antiquated.“Part of it is that the IT department isn’t supporting the user well enough, and the user wants to make their own life as easy as possible, so they will use alternatives,” he said. “And it’s difficult to stop them using those alternatives.”The Canopy survey said more than two-thirds of respondents viewed their IT department’s sluggishness as a key factor that would push departments further into the arms of third-party service providers.This unresponsiveness manifested itself as a failure to sanction short-term pilots quickly enough, and to host products for launches in a timely enough way.What kind of policy can the IT department put in place to stop naughty users from exposing corporate data in the cloud? The most draconian one is the grumpy cat approach: simply blacklist everything.Corporate filtering systems can easily block a list of URLs. While these blacklists have most commonly been used to switch off porn sites, social media, and videos of dogs walking on tight ropes, they could just as easily be configured to block a growing list of cloud-based services that users might be using as temporary file dumps.Not so fast, warns EMEA marketing director Nigel Hawthorn at Skyhigh Networks, which helps companies find the cloud-based services being accessed within client networks. It uses this data, aggregated from organisations around the world, to produce a report every quarter.

In the first quarter of 2015, the average firm used 923 distinct cloud services, the Skyhigh Networks estimates. That's more than a fifth more than the year before and around 10 times higher than IT estimates. It's also going to lead to an awfully big black list, a list that's growing all the time, Hawthorn said."We are adding 100 new cloud services to the registry every week," he explained. "Old-style web filters find it difficult to work out where to put them.”Typically, URL blockers will have a few tens of categories for different sites, ranging from porn to social networks, entertainment and sports. "Where do you put a cloud service that could be used for many different things?" Hawthorn asks.In any case, if you just try to block everything, you often achieve the opposite effect, pushing your users away from well-established and reputable sites into specious online apps run out of someone’s shed. Far better Dropbox, say, than Yuri’s MegaBling Filesharing Service.Alternatively, they will simply find other ways of accessing the mainstream cloud services that they were using before. Once, people would bring modems into their office to get dial-up access to the internet at work. Today, 4G “Mi-Fi” hotspots and rogue Wi-Fi access points are an alternative.

“It’s a device that the laptop thinks is a hotspot, and it connects to data services. So people can get around the URL filters that block them from doing certain things. Now all of a sudden you have a rogue Wi-Fi access point that doesn’t even exit through the firewall,” said John Pescatore, director of emerging security trends at the SANS Institute.He warns this will become a bigger problem in the future. “The reason that this is starting to reach the tipping point is how often you turn on your device and search for Wi-Fi. You see dozen of these things,” he warns.So, simply blocking cloud services is problematic. What other options exist? Perhaps content management systems, which manage document workflow throughout an organisation, could help?These solutions grant access to documents based on permissions set by administrators, who can set security profiles to enforce access controls. It's a nice idea, says Kirby-French, but don’t hold your breath.“You’re quickly trying to work on a document and you click upload, and it takes 30 seconds for a 10MB PowerPoint presentation. And every time you want to change it you have to check it in and out that takes time,” he said.

Again, you’re trying to overcome people's inherent desire to make life as easy as possible, so giving them extra hoops to jump through may not be appropriate.Such systems might yet have traction with documents that have a specific sensitivity level, according to Trustmarque cloud services director James Butler. “You can train a team that deals with a particular kind of document, and you can tell them that they can only use this one system,” he said.Companies can also use rights-management technology to encrypt documents that have a certain level of sensitivity, only allowing certain users to see them, he added. Microsoft has rights-management technology both for Active Directory, and for its Azure cloud.A productive approach to managing security in a cloud-based world will be nuanced, involving some give and take between IT departments and users alike. It starts with a basic audit, in which IT departments work out what cloud services are already being used without authorisation.You can try and strike an amnesty with departmental managers to find out from them what they are accessing, or you can do your best to mine network logs.There are various firms that will discover your network’s exposure to existing cloud services for you. Aside from Skyhigh Networks there’s also Netskope, and Ciphercloud.Next, evaluate what these cloud services do. What kind of service users accessing, and why? This can help you to understand what users need that they are not getting from the organisation.

comments powered by Disqus