Microsoft’s announcement of its new Windows11 operating system, together with its new Server 2022 platform has been welcomed by users who will receive upgrades by mid-2022.

However, the availability or new releases has, in many instances, prompted companies to undertake an inventory of their Microsoft software. The results have been startling, according to Deon Smal, CEO of Cyber Insight, a Cape-based cyber security assessment firm.

“As companies prepare to take advantage of Microsoft’s new releases, many have realised that older versions of Windows – Windows XP, Windows7 and Windows8 – are running without security upgrades exposing significant vulnerabilities within corporate IT systems,” he says, confirming that a similar situation exists in organisations with legacy systems on Microsoft’s Server 2003 and 2008 platforms.

Smal points to the most common cases of neglect which centre on embedded industrial computing systems such as those associated with robotics, the interdisciplinary branch of computer science and engineering commonly linked with tasks such as process control in chemical plants, large printing works and production line facilities.

“Often downtime has not been scheduled to effect upgrades to these legacy systems, or the critical need to upgrade them has not been realised due to financial constraints,” he says.

“Moreover, failures in corporate inventory management and procedures often mean that those responsible – IT managers and CEOs – are in the dark and are shocked to learn of the extent to which their organisations are exposed to cyberattacks.

“In unprotected legacy systems, these regularly focus on unauthorised access to critical systems, privileged escalation into other systems, ransomware and denial of service attacks, all of which could lead to catastrophic levels of business disruption.

Smal notes that hackers and those with malicious intent are frequently aware of legacy systems in operation and make use of “exploit kits” that take advantage of the opportunities presented by out-of-date software in industrial as well as commercial and work-from-home applications.

“Should an organisation be alerted to systems running outdated software, an emergency solution would be to isolate these systems through the use of network segregation, thus separating them from other internal networks and – significantly – the Internet,” explains Smal.

“Network segmentation can be rapidly achieved through the professional implementation of appropriate firewalls, virtual networks and other contemporary techniques,” he adds.