Support for Windows XP has finally come to an end, giving way to a whole host of issues for the thousands of businesses that have remained on the operating system, despite there being several upgrades available.
Security is definitely at the top of the list of those concerns, as discussed at a recent roundtable event I attended, hosted by Dell.
The reality is that with no more patches or security updates, it leaves those organisations still running XP vulnerable to threats and attacks from cybercriminals.
Businesses have known for a while that support is ending and that they must rethink their strategy, but not all of them, particularly smaller organisations, have migrated away yet. So what should the next steps be for those businesses still running XP? Here are my tips:
Understand the goals of the business
Once you have an end-to-end understanding of where the business is headed you will be able to determine the needs of the business and the associated security requirements. It is important to engage with someone who understands risk; for example the cost of a refresh could have a big impact on the business, but what are the consequences if a security breach occurs? These need to be weighed up against each other. Governance and compliance are also important factors when considering risk levels.
What tweaks can be made to improve security in the short-term?
Security is a layered approach. It is not possible to ever be 100% secure, instead you build layers of protection and aim to be as secure as possible within your means. If you’re still running XP, think about what quick wins you can achieve without any major investment – for example, are your patching policies for other applications being carried out properly? Is your application performance management (APM) up to scratch?
Monitor and manage
Review your estate and work out everything that is still running XP. Once you have a list in place make sure you closely monitor for any changes that suggest something is amiss. A SIEM (Security Incident Event Monitoring) solution can help control your XP environment here, but having the right resource in place is also key – check that your team has the skills and knowledge to monitor your systems and flag any potential issues. Putting clear policies and processes in place will also help to ensure things run smoothly.
Plan your migration strategy
It is possible to carry on using Windows XP – Microsoft is still releasing patches, but only for those organisations paying for support – but it just increases the risk the longer you stay on the operating system. These patches are secure but every time one is released it is effectively telling cybercriminals what the vulnerabilities are, which is not good for those companies who aren’t paying for support.
Continuing to run XP is like driving down the motorway without a seatbelt on – you might be alright but if you have a crash it could result in disaster.
My advice would be to work with the business to understand the strategy, work with vendors and partners to understand what is going to be supported and then plan your migration strategy accordingly, remembering to build security into the very fabric of the infrastructure.
