Discussing Windows® XP End of Support with Management: 5 Key Factors

Lenovo recommends Windows 8.

© 2014 LENOVO. ALL RIGHTS RESERVED.

2


End of Support for Windows XP Has Arrived


3


Microsoft has stopped free support of Windows XP. – No automatic security patches and updates create security vulnerabilities. – The only option for enterprises is a high-cost Custom Support Agreement (CSA). – Many third parties will also end support in the same time frame.

The impact goes well beyond IT: – Compliance – Regulatory – Statutory

Management must be made aware of the risks and ongoing issues due to the End of Support (EOS).

Windows XP End of Support Date – April 8, 2014


4


Identify the business issues that will impact the organization.

Provide a solution for migration from Windows XP.

IT’s Role


Image: https://blog.bit9.com/2013/10/25/how-does-windows-xp-end-of-life-affect-you/

5


1. Security vulnerabilities become known, but won’t be mitigated with Microsoft patches after April 8.

2. The lack of up-to-date software can create legal issues.

3. Key software vendors may also end support of Windows XP, leading to additional vulnerabilities.

4. Security threats to Windows XP are not solely focused on the operating system.

5. The cost of buying a CSA is quite high and difficult to justify.

The 5 Top Windows XP Issues for Management


6


Windows XP is a Target


Infection and encounter rates for Windows XP are still high indicating more concerns after EOS

Source: Microsoft Security Intelligence Report Volume 15

7


New security vulnerabilities in Windows XP are discovered fairly regularly. In the past, Microsoft would address these issues with updates delivered on what is known as “Patch Tuesday.” The free service ended on April 9, 2014.

Vulnerabilities are shared among hackers using any number of Internet sites and message boards, resulting in rapid disclosure of vulnerabilities.

New patches for Windows 7 and Windows 8 may actually point to vulnerabilities in Windows XP, as some elements of the operating systems are similar.

Security Vulnerabilities without Patches


8


IT Must Help Management Get Facts about Windows XP


Image: http://betanews.com/2013/09/02/5-big-myths-surrounding-computer-security-and-hipaa-compliance/

9


Numerous compliance and legal directives demand current or up-to-date software, something that will not be true for Windows XP as of 4/9/14.

Privacy statutes such as Massachusetts’ general law 201 CMR states the need for “reasonably up to date [with] operating system patches,” and many other state laws have similar demands.

Sarbanes-Oxley states that IT auditors “will identify the related technology components and general controls that provide assurance of processing and data integrity for the key applications.” Windows XP with known vulnerabilities will not meet this standard.

HIPAA demands that entities must implement appropriate security measures to reduce those risks and vulnerabilities to a “reasonable and appropriate level,” clearly a difficult demand under Windows XP.

There are numerous problematic compliance and legal directives across the globe.

Legal/Compliance Issues from Using Windows XP


10


Some of the key security software suppliers have not announced continuing support for Windows XP.

Mobile Device Management (MDM), Identity Management, VPN, and other key security tools are not likely to be supported by all vendors.

Device drivers, a potential source of intrusion, are likely to lose support under Windows XP.

Microsoft’s recent announcement of continuing delivery of malware signatures is only a small part of the solution.

Other Software Vendors Abandoning Windows XP


11


The operating system is only part of the software “load” that exists on older PCs that use Windows XP. There are many other parts of the overall software “image” that may be vulnerable.

The browser Internet Explorer (IE) is a particular point of focus for hackers. Windows XP cannot use the most up-to-date versions of IE (versions 9 and above), and there are known security holes in the older versions of IE.

The common practice of providing each Windows XP user with “Administrator” rights (full rights) to the system make it simpler for browser-focused exploits, such as the remote administration tool, RAT Poison Ivy, to take complete control of the system.

The issue of compromised device drivers is also important to mention in this context.

Threats from Windows XP Beyond the Operating System


12


Based on a ComputerWorld news article, one enterprise reported that the CSA price for Year 1 for 5,000 Windows XP systems was quoted at $1 million, or $200 per system!

The prices are also going to rise in Years 2 and 3.

Microsoft also indicated that no CSA will be provided beyond 3 years.

The cost of a CSA, changing non-supported software, and updating the system to offer what little protection is possible are all poor investments.

The Cost of a Custom Support Agreement is Quite High


13


Despite some press articles, securing Windows XP to a standard required by corporations, after April 8, is basically not possible due to multiple areas of vulnerabilities.

The only option that will meet compliance and legal requirements is migration to Windows 7 or Windows 8.

Further, given the advanced age and increased potential for failures, upgrading older PCs is not the most cost-effective approach.

Solutions to Windows XP Security Issues


14


Windows XP is from Another Era of Computing


15


Most IT organizations do not have the resources in-house to devote to a mass migration.

Service providers offer the speed, expertise, documented processes, and bandwidth to drive a large-scale migration.

Options for Large-Scale Windows XP Migration


16


In-Place Migration – In as little as 20 minutes, an individual PC can be updated to Windows 7.

Imaging Services – Enable the creation of standard

or custom images and allows for putting multiple images into a single deployment; only needed image elements to be installed.

Lenovo Services for Mass Migrations of Windows XP


17


Lenovo Migration Services


18


Lenovo: http://www.lenovo.com

Lenovo Transition Services: http://www.lenovo.com/services_warranty/us/en/transition-services.html

Lenovo In-Place Migration: http://www.lenovo.com/services_warranty/us/en/in-place-migration.html

Lenovo Imaging Services: http://www.lenovo.com/services_warranty/us/en/imaging-services.html

Lenovo White Paper: http://www.lenovo.com/us/en/solutions/discussion-migration-management.shtml

Lenovo Resources


http://www.lenovo.com/

http://www.lenovo.com/services_warranty/us/en/transition-services.html

http://www.lenovo.com/services_warranty/us/en/in-place-migration.html

http://www.lenovo.com/services_warranty/us/en/imaging-services.html

http://www.lenovo.com/us/en/solutions/discussion-migration-management.shtml

http://www.lenovo.com/us/en/solutions/discussion-migration-management.shtml

Discussing Windows® XP End of Support with Management: 5 Key Factors

Technology

Transcript of Discussing Windows® XP End of Support with Management: 5 Key Factors