David Sancho, Senior Threat Researcher at
Trend Micro (on photo),
Trend Micro (on photo),
about the end of Microsoft XP. Obsolete and
unpatched, he describe three kind of person
still using this 13-year-old operating system.
XP still in 28% of all PCs worldwide
Windows end of support this, Windows end of
support that… a lot of people in the IT field are
writing about how Windows XP support have been dropped since 2 days ago. Why is this a big deal?
Like any other software, operating systems
evolve and it takes too much effort for the
companies who created them to keep supporting older versions as time goes on. All Windows versions eventually become obsolete – try to call Microsoft today about that Windows 95 problem you still have and see what kind of response you’ll get. Windows XP, however, is a completely different case. Usually, when support for a Windows version ends that particular version is no longer used in great numbers.
That’s not the case here. Depending which
source you use, Windows XP is still in use in at
least 18%, to as much as 28%, of all PCs
worldwide. Yes, hard as it is to imagine,
somewhere around a fifth or fourth of all PC use an operating system that was released in 2001.
A security problem
When Microsoft leaves these users out in the
cold after April 8, any security problem they have in the future will be left unpatched; those
millions of PCs will not have any available
Microsoft-supplied fixes. Of course, you can still use antivirus software and be protected that way, but newly-discovered security holes in the operating system will not be fixed and therefore will be left wide open for attackers to use.
cold after April 8, any security problem they have in the future will be left unpatched; those
millions of PCs will not have any available
Microsoft-supplied fixes. Of course, you can still use antivirus software and be protected that way, but newly-discovered security holes in the operating system will not be fixed and therefore will be left wide open for attackers to use.
Why are so many people still using a 13-year-old operating system, I hear you ask?
Many of these users fall into three groups. What do each of these groups need to know now that patches are no longer coming?
Kinds of users;
Group 1 – Simple users that consider the OS a
mere tool.
mere tool.
Many of the remaining users of XP have a very
practical view of their machines. Their
philosophy is, “if I have a screwdriver that works, why bother buying a new one 10 years down the line if the old one still works”. Their XP machine does what they need and they’re happy enough with it.
The problem with this line of thinking is that
modern operating systems do get old with time. The screwdriver analogy is flawed in; it’s
something extremely simple that never needs an upgrade. Try something more complex for an analogy; how about prescription glasses?
They become obsolete after a while – either
when they get out of fashion, or your eyes
change (normally for the worse, unfortunately).
Imagine you’re left with old prescription glasses that only one optician can change and this optician goes out of business. You’re on your own. Same with Windows XP.
If you’re in this situation, maybe it’s time to
consider a simpler computing device. If all you
do on your PC is check your email and go on
social media, maybe it’s time to consider using a tablet instead of a PC.
practical view of their machines. Their
philosophy is, “if I have a screwdriver that works, why bother buying a new one 10 years down the line if the old one still works”. Their XP machine does what they need and they’re happy enough with it.
The problem with this line of thinking is that
modern operating systems do get old with time. The screwdriver analogy is flawed in; it’s
something extremely simple that never needs an upgrade. Try something more complex for an analogy; how about prescription glasses?
They become obsolete after a while – either
when they get out of fashion, or your eyes
change (normally for the worse, unfortunately).
Imagine you’re left with old prescription glasses that only one optician can change and this optician goes out of business. You’re on your own. Same with Windows XP.
If you’re in this situation, maybe it’s time to
consider a simpler computing device. If all you
do on your PC is check your email and go on
social media, maybe it’s time to consider using a tablet instead of a PC.
Group 2 – Users with a genuine need for
Windows XP
Windows XP
The ancient OS has become the only tool that
this particular group of people can use. Think
ATMs, POS systems, Surveying and GIS softwares, medical devices, certain
machines that are not easily upgradable, or
whose hardware is too old for a newer operating system.
In some cases, virtualizing the OS might do the
trick. Combined with a product that blocks
attacks against the virtualized environment, this setup might be able to keep attacks at bay.
Isolating them from the Internet is also a
possibility, though not always realistic. Users on these systems will need to be especially
cautious with everything that goes in and out of these devices, whether online (the Internet) or offline (removable media, etc.) Regular, even
daily backups can help here. Pray a lot, as in this situation your margin for error is frighteningly small.
this particular group of people can use. Think
ATMs, POS systems, Surveying and GIS softwares, medical devices, certain
machines that are not easily upgradable, or
whose hardware is too old for a newer operating system.
In some cases, virtualizing the OS might do the
trick. Combined with a product that blocks
attacks against the virtualized environment, this setup might be able to keep attacks at bay.
Isolating them from the Internet is also a
possibility, though not always realistic. Users on these systems will need to be especially
cautious with everything that goes in and out of these devices, whether online (the Internet) or offline (removable media, etc.) Regular, even
daily backups can help here. Pray a lot, as in this situation your margin for error is frighteningly small.
Group 3 – Enterprise users
The last group of Windows XP users are
enterprises that haven’t gotten around to
upgrading their large installations of Windows
XP.
We feel your pain. Upgrading hardware is never
easy, training the users might take time, budget
is tight, those kinds of excuses. Well, just
remember this: if you have to recover after a
massive attack, excuses won’t mean much.
We’ve known for years that Windows XP’s
support would be ending now; there’s very little
excuse for not being prepared for it.
You have to think that while you’re using
Windows XP out of support, any zero-day
attacks (and there is a very good chance there
will be some) will not be solvable. Yes, you can
temporarily manage the risks, but that’s not a
permanent solution. It is like having a big crack
in your wall that you can patch over with
wallpaper for a while, but nobody may never be able to repair. Enough said.
enterprises that haven’t gotten around to
upgrading their large installations of Windows
XP.
We feel your pain. Upgrading hardware is never
easy, training the users might take time, budget
is tight, those kinds of excuses. Well, just
remember this: if you have to recover after a
massive attack, excuses won’t mean much.
We’ve known for years that Windows XP’s
support would be ending now; there’s very little
excuse for not being prepared for it.
You have to think that while you’re using
Windows XP out of support, any zero-day
attacks (and there is a very good chance there
will be some) will not be solvable. Yes, you can
temporarily manage the risks, but that’s not a
permanent solution. It is like having a big crack
in your wall that you can patch over with
wallpaper for a while, but nobody may never be able to repair. Enough said.
No comments:
Post a Comment