Microsoft recently announced that they have stopped providing support for one of their key operating systems. Windows XP was created in 2001 by Microsoft as part of their Windows NT family of operating systems and, during its 13 year lifespan, Windows XP became a staple for many PC users being used in peoples’ homes and businesses. The initial announcement for the discontinuation of the product was made during 2009, giving people five years to move to a newer operating system. As many home and commercial users make use of XP, there has been a lot of discussion regarding what the end of XP’s life will mean for the online security of these users.
Contrary to what many people believe, the end of life for an operating system does not mean that they will be unable to continue using it. Windows XP will still be fully accessible and will be available to be installed on PCs. What it does mean is that no new updates will be published by Microsoft for that operating system, which extends as well to all Microsoft products associated with it (IE, Office Suite, etc.). So what’s the problem?
The main issue is with any new security vulnerabilities that are discovered. Windows XP users would not be able to protect themselves from any new issues that are found. A very real example is the vulnerabilities identified on Microsoft's Security Bulletin (MS14-029) describing an issue on all versions of Internet Explorer that could allow an attacker to execute code on the victim's machine just visiting a malicious page. Due to the end of line for Windows XP, no official patches have been created for the affected versions of the operating system, leaving users vulnerable to this attack. This is a major indication that using Windows XP is no longer safe and a change to a newer operating system is required.
Unfortunately, issues with legacy software mean that it is often difficult for companies to make the migration from an earlier operating system to a more current one. All is not lost if you are not able to do that migration in the short term. There are some things you should do now to reduce your vulnerability to malicious attacks:
• apply the latest O.S. patches: Make sure that all Windows XP hosts are updated to their latest available version and all security patches are successfully applied
• install antivirus software: All XP hosts should have antivirus software installed and fully updated; this will make sure that any known attacks will be stopped before accessing information on the hosts
• configure your firewall properly: The system firewall should be correctly configured to allow access only to the services that are being used
• change the default browser: Internet Explorer is currently vulnerable to attacks that will not be officially patched. Both XP versions of Chrome and Mozilla Firefox are still supported and will be updated for any new security vulnerabilities found
• use a limited account: Instead of using an Administration account on the system, an account with minimal priveliges should be used to ensure that in a case of a system breach, the attacker will be restricted on what they will be able to access on the system
• keep a copy of hardware drivers: Due to the end of life of Windows XP, there is a high possibility of more companies dropping their support for this version of Operating System. Make sure that you have all the latest drivers for the hardware being used by the host, as after they are discontinued there is a high chance of malicious executables, posing as valid drivers, appearing on the internet.
We recommend that to avoid the risk of attack, where possible all users should migrate to a newer version of operating system as soon as possible, to protect their data and sensitive information from malicious attacks.
For more information, or to book a penetration test, call us on 0870 600 1667 or email firstname.lastname@example.org