Microsoft issues its final security update this week for Windows XP, the 13-year-old operating system that remains the second most used platform in the world despite the certainty that after April 8 it will rapidly become dangerously insecure.
Here is a set of questions and answers that help to explain this phenomenon and to offer some advice for those still using XP.
What's the big deal?
When Microsoft stops supporting XP criminals will keep on finding new ways to exploit the operating system. The list of unpatched exploits will grow and grow to the point that compromising XP machines will be elementary for hackers. Data on XP machines will be at risk. XP machines on networks will become launch pads for internal attacks against better supported machines. They could easily be recruited into botnets to launch coordinated DDoS attacks or massive spamming.
Will XP machines stop working?
Why is Microsoft doing this?
Microsoft publishes a lifecycle for all its operating systems; all of them eventually reach end of support, and end of support is announced literally years ahead of time. As operating systems age, they fall behind in their native security features and are unable to take full advantage of more advanced hardware. Using some internal calculus, Microsoft decides on what the best time is for end of support for each of its products.
How many machines still run Windows XP?
Hundreds of millions. One estimate by StatCounter says that for the month of March, 17.16% of Internet-connected computers in the world ran XP. In businesses, Gartner estimates that up to a quarter of enterprise computers will still run XP and that a third of business networks will continue to run XP on more than 10% of their machines. Qualys estimates that the overall 10% of business computers still run XP.
What's wrong with people that they didn't upgrade?
Some people just procrastinate inexplicably but others have good reasons. Cost is a factor. Upgrading can involve buying new hardware, time and money to transfer files. Some business-critical software won't support newer operating systems and the cost of rewriting the software is prohibitive. XP is the operating system for some manufacturing machines necessary to businesses, and the makers of these machines haven't made any provision for upgrades.
What about automated teller machines? Are they safe?
It depends. Since it's estimated that 95% of ATMs still run XP, potential danger is there. If banks pay for extended support, they shouldn't be any more susceptible to attacks than they were before. These machines might connect only to private networks, which makes them easier to defend than if they are exposed to the public Internet. It makes sense that banks would have been working out what do to given that widespread breaches due to unsupported XP would be disastrous for their business.
Sign up for CIO Asia eNewsletters.