Stop Talking About Threat Detection and Start Eliminating Known Security Exposures

Update March 2021

This blog was published in 2018, well before the global COVID-19 pandemic. With the pandemic, came a sharp rise in cyberattacks across all fields and organizations. To read a collection of sobering statistics on the subject, see 52+ Scary Hacking and Cybersecurity Statistics You Need To Know for 2020.

For those not in the know, basta is an Italian or Spanish word that translates to “enough already!”
It’s time to start doing something about security exposures in legacy systems. Too many organizations are running decades old systems that have well known and widely documented hacks. 2017 and 2018 brought an endless string of news stories describing hacking of critical infrastructure, nuclear power plants, power grids, water facilities, hospitals, banks, credit scorers, and online service companies.

The WannaCry and NotPetya hacks rely on security exposures in WS2003. These hacks continue to evolve and have caused millions of dollars worth of ransomware incidents in the last 12 months. Cyber attacks on legacy systems are not going to slow down. According to Symantec, ransomware attacks increased by 36 percent in 2017. Malware and phishing are becoming more sophisticated. The techniques and code used to hack and compromise systems are well documented and widely distributed on the internet, on social media, and hacking forums.

Problem detection is not a solution

The last thing companies need to fix their cyber security problems is to buy more cyber threat monitoring and detection systems. Most of the spending and effort involved in cyber security are focused on monitoring and forensics. These activities, however, are after the fact – after a massive security breach has already happened. They determine who left the barn door open once the horse is gone.

I’m here to tell you two key things:

There is no door on the barn

Some simple automated steps can put a door back on the barn and lock it

Problem detection is not a solution. Cyber threat detection tools will not and cannot close a security hole if the barn doesn’t have a door, no matter how much money you pour into these tools. If you don’t close known system hacks, they will not magically disappear.

What needs to be done

The first step is simply to stop procrastinating and start fixing well known legacy system exposures. As WebTitan states, if you’re “still running outdated, unsupported operating systems or software, you are taking unnecessary risks and are leaving your network open to attack.” It’s time to address security exposures by modernizing, not just once, but continuously. Modernizing means moving legacy applications to modern, more secure operating systems and hardware.

According to Sean Joyce, global financial crimes and US cyber security and privacy leader at PricewaterhouseCoopers (PwC), “Managing cyber risks is like managing any other kind of business risk – it requires trade offs. It comes down to proactively aligning resources to mitigate the likelihood of cyber security incidents…”

  1. If you’re running applications on old Windows systems, upgrade your hardware and operating systems. You’ll need to spend some money to do this, but these are modest investments in comparison to spending more money on yet more cyber security tools.
  2. Buy modern server hardware to close known hardware security exposures like Meltdown and Spectre.
  3. Move your software application stacks from old operating systems like NT WS2000, WS2003, and WS2008 to modern, more secure WS2012 and WS2016 systems to eliminate WannaCry and other malware exposures.
  4. Use an automated migration tool to move your legacy applications to a new server and OS.

Migration Intelligence can help

Use an automated migration tool to isolate older application stack and dependencies from the underlying OS. Then move your legacy applications to a new server and OS (upgrading web server and database components on the fly as required).

Migration intelligence automatically puts the old software stack components in the right place on the new OS, just like a fresh install. You don’t need install scripts for your legacy applications. Automated migration takes care of the move in just a few hours and saves the weeks and months of effort usually needed to upgrade applications to new servers and test them.

Basta, It’s time to close the barn door

We should stop talking about cyber threat detection and stop focusing on cyber security technology based on problem identification. It’s time to close the barn door. It’s time to move applications to new, secure servers.

It’s negligent to ignore the known security risks inherent in outdated servers and operating systems. Organizations that continue to do nothing about fixing the security exposures of legacy systems may face serious legal claims from customers, shareholders, and governments when data breaches happen. Consumers are increasingly asking that companies be held responsible for securing the large amounts of personal data they collect and maintain.

If you are serious and need help with upgrading your Microsoft Server applications or would like to understand Migration Intelligence, don’t hesitate to give us a call. We modernize applications and move them to new secure Windows operating systems every day. We’d be pleased to share what we know.