XP and 2003 End Of Life -- Don't Panic

by Scott Lewis

Yes it is true, Microsoft is going to be ending support for XP and Windows 2003 Server in April 2014 but don’t panic and feel like you have to run out and replace your current workstations and servers. The truth be known, Microsoft has been saying for years that these products are at the end of life and to start upgrading. Microsoft hasn’t released a significant upgrade to either product since 2011. Minor security patches, yes, but not any major upgrades. So this should not come as any surprise, and the reason it is a big deal now is because IT people are now viewing it as opportunity to upgrade in a panic. Oh and our favorite reason is security, which we know typically throws owners and executives into a panic and the budget becomes secondary. The truth is that security issues with XP and 2003 have long been documented, but due to the stability and reliability of XP corporations decided to stay with the product verse upgrading.

What are the risks of remaining on XP and Windows 2003 Server? Due to the very long life of XP and Windows 2003 they are very well documented operating systems so the vulnerabilities that they have are very well known. However, for corporate networks security should be a layered active approach which should if properly configured and monitored provide a level of security that won’t eliminate the risk but lower the risk of an attack on your network. Hackers will typically take security releases from Microsoft and try to reverse engineer them to determine the level of access that they may have, but this has been going on for years, and they are doing the same thing with Windows 7 and 8 and they will continue doing that with whatever comes next. Another little known fact or at least one we really don’t want to talk about is that the highest risk of stolen data is not to a hacker on the Internet, it is your employees which have too much access to your data, so remember you have to secure the inside of your network as much as you have to secure the outside.  

As a whole Windows 8 has significantly improved security and built in protection than any other operating system that came before it.  However people have been slow to warm up to Windows 8 which is primarily due to the learning curve that comes with it.  In a corporate environment this migration to Windows 8 is certainly outside of the comfort zone which again has created a slow adoption rate. Hackers have historically focused on the vulnerabilities of the operating system, however now it is much more common to and easier to focus on the vulnerabilities of the applications, browsers and document readers. With the evolution of the tools that are used by hackers, they have certainly become much more effective at gathering and infiltrating networks which does add to the risk of continuing to leave XP running on your network.  The overall exposure has increased due to these factors, but these same factors have been accepted for many years within your company if you are still utilizing XP as an operating system…so don’t panic.

Upgrading from XP or Windows Server 2003 is something you must do if you are still using these operating systems, however the house is not burning down so don’t do it in a panic by opening up the purse strings and spending any more money than is necessary. There are steps you can take which are really best practices regardless of the operating system version, but these steps will help you reduce the risk and exposure to your companies network and data.

-Route Password changes – users, administrators, and service accounts.
-Eliminate unnecessary shares on your network. Restrict and monitor web browsing on your network
-Don’t allow people to download applications off the Internet
-Require Anti-Virus to corporate standards on “Bring your own device” to work equipment.
-Don’t give employees any more access to network resources than required to do their jobs.
-Insure that Firewalls, Routers, and other network devices are patched and on current software versions.
-Filter any executable files out of your email system, and block at firewall.
-Don’t allow employees to load programs or run unapproved applications on their workstation.
-Restrict administrator level access to local workstations.

-Monitor the inside of your network for large file transfers, or other risky activity.

These may seem like extreme steps in some cases, however it will help protect your business, until you have the time and resources to effectively migrate to Window 8.

A migration doesn’t have to be hard or difficult and it certainly doesn’t have to be done in a rush, because what you may not know is that if you are still running XP than you have already been facing these risks it just wasn’t getting the press that it is now. Development of a strategy to upgrade to Windows 8 with a timeline, budget and training is the prudent business thing to do because you need to do it. However, like any industry there is a lot of press about doing it now due to the April 8th end of support date set by Microsoft, there is not hardware shortage, software shortage or any of the other creative marketing that I have seen going around but as business owners you should start thinking about it.

Scott Lewis is the President and CEO of Winning Technologies Group of Companies.  The Winning Technologies Group of companies is an international technology management company. Scott has more than 30 years of experience in the technology industry, is a nationally recognized speaker on technology subjects such as Collocation, Security, CIO level Management, Data and Voice Communications and Best Practices related to the management of technology resources.  Learn more about Winning Technologies at www.winningtech.com.