Why You Need to Upgrade from Windows XP (and Windows Server 2003)
Support for Windows XP ends in April 2014, with Windows Server 2003 following in July 2015. But what does this mean for users and organizations still running these products? Microsoft recently warned that Windows XP users face ‘zero-day’ vulnerability forever on their PCs, as once the company stops releasing security updates, the defenses built-in to the aging OS won’t be enough to fend off today’s sophisticated attacks.
Windows’ OS Infection Rate
What struck me was not this piece of unsurprising information, but the results of Microsoft’s Security Intelligence Report 14 from the fourth quarter of 2012, which uses data gathered directly from the install base of each OS. As you can see in the figure below, while it’s no surprise that Windows XP is considerably more prone to infection than later versions of Windows, it’s twice more likely to be infected than Windows Vista. The data in the report is normalized, so a sample of one thousand computers was analyzed for each operating system version.
Windows 8 has a particularly low infection rate, but that could be due to the fact the OS had only just been released at the time the report was published, when attacks that specifically target the improved defenses of the OS were few. Additionally, it’s worth remembering that Windows 8 is the first version of Windows to include signature-based malware protection out of the box. With the imminent release of Windows 8.1, we may see those figures improve further as Windows Defender adds network-level inspection to the mix.
What is “Inside Microsoft Teams”?
“Inside Microsoft Teams” is a webcast series, now in Season 4 for IT pros hosted by Microsoft Product Manager, Stephen Rose. Stephen & his guests comprised of customers, partners, and real-world experts share best practices of planning, deploying, adopting, managing, and securing Teams. You can watch any episode at your convenience, find resources, blogs, reviews of accessories certified for Teams, bonus clips, and information regarding upcoming live broadcasts. Our next episode, “Polaris Inc., and Microsoft Teams- Reinventing how we work and play” will be airing on Oct. 28th from 10-11am PST.
Microsoft’s Security on the Server
Microsoft wasn’t able to collect enough data on Windows Server 2012 to provide reliable measurements to include in the report. However, we can see that Windows Server 2008 R2 SP1 is infected a lot less than Windows Server 2003 with Service Pack 2, and I think we can safely assume that Windows Server 2012 will show good results in the next report.
As servers are not generally used interactively in the same way as desktop PCs, with the exception of terminal servers, they are at less risk. So replacing Windows XP might be more of a priority than upgrading to Windows Server 2012. Furthermore, it may not be easy for organizations to move legacy applications away from old versions of Windows Server for compatibility reasons.
Nevertheless, you should consider planning to upgrade Windows Server 2003 to Windows Server 2012 before 2015. This may also allow you to utilize Server Core, which provides a more secure OS than the GUI version of Windows Server. If it’s not possible to move from Windows Server 2003, special attention will need to be paid to securing the server post-2015.