Windows Server 2003, how big a problem is it?

Summary

This blog post, "Windows Server 2003, how big a problem is it?", is a blueAPACHE article from 2014 covering security. As Microsoft confirms that Windows Server 2003 will no longer be supported (or more importantly, no longer receive critical service packs or security updates), we are learning that the need to start migrating away is rapidly becoming something businesses should be prioritising now, not next year. It is written for readers evaluating emPOWER Security, emPOWER Cloud. The underlying security practice it describes, reducing attack surface and improving detection and response, is not tied to a specific product version and remains relevant to any organisation managing cyber risk today.

Key facts

Article

As Microsoft confirms that Windows Server 2003 will no longer be supported (or more importantly, no longer receive critical service packs or security updates), we are learning that the need to start migrating away is rapidly becoming something businesses should be prioritising now, not next year. According to Forrester’s Richard Fichera, there are still approximately 9 million Windows Server 2003 systems running today, with another 2+ million instances running as virtual machine guests. Overall, that equates to around 11 million operating system images and a ton of hardware that will need replacing and upgrading. The challenge facing business is that many Windows Server 2003 servers are legacy servers, quietly running some mature piece of code, often in satellite locations or third party vendors. The application workloads are a mix of software vendor and bespoke code, but it is often a critical line of business applications that have long since migrated to newer platforms. Identifying where they are can proving troublesome. Once identified, the second challenge is working out whether the legacy applications and bespoke code will actually run on new server or cloud platforms. With the amount of custom code typically involved (and the potential time required to migrate, rebuild and update code), the need to perform an aggressive stock take on all systems now – not next year. This is paramount to maintain business continuity, mitigate security concerns and manage risk, and will only become more so as we move closer to the July 2015 deadline and resources become harder to secure. For a discussion on how to identify and mitigate your Windows Server 2003 risks, contact blueAPACHE.

Related

• emPOWER Security
• emPOWER Security (pillar hub)
• emPOWER Cloud
• emPOWER Cloud (pillar hub)

Frequently asked questions

How many Windows Server 2003 systems does the article say were still running at the time?

The article cites Forrester's Richard Fichera, stating there were still approximately 9 million Windows Server 2003 systems running, plus another 2+ million instances running as virtual machine guests. It totals this at around 11 million operating system images still in use.

What deadline does the article give for migrating away from Windows Server 2003?

The article names July 2015 as the deadline it is working towards, noting that risk grows and migration resources become harder to secure as that date approaches. It frames the article's publication date of 2014 as the point at which businesses should already be prioritising migration.

What two-stage challenge does the article describe once a legacy Windows Server 2003 workload is found?

The article says the first challenge is locating legacy servers, which are often quietly running mature code in satellite locations or with third-party vendors. The second challenge, once found, is working out whether the legacy applications and bespoke code will actually run on new server or cloud platforms.

What kind of applications does the article say typically still run on Windows Server 2003?

The article describes a mix of software-vendor and bespoke code, often supporting critical line-of-business applications that have long since migrated to newer platforms elsewhere in the organisation. This is why it says an aggressive stock take of all systems is needed to find them.

Why does the article say businesses should act now rather than next year?

The article argues that migrating away from Windows Server 2003 is paramount to maintaining business continuity, mitigating security concerns and managing risk. It states this urgency will only increase as the July 2015 end-of-support deadline nears.

Does Windows Server 2003 continue to receive security updates after the point the article describes?

No. The article states that once Microsoft's support ends, Windows Server 2003 will no longer receive critical service packs or security updates, which is the core reason it says migration cannot be delayed.

What does the article recommend a business do to manage its Windows Server 2003 risk?

The article recommends performing an aggressive stock take of all systems immediately, given the volume of custom code involved and the time required to migrate, rebuild and update it. It presents this stock take as the first practical step before any migration work can begin.

How does the article suggest a reader get help identifying and mitigating Windows Server 2003 risk?

The article invites readers to contact blueAPACHE directly for a discussion on how to identify and mitigate their Windows Server 2003 risks. It does not set out a self-service checklist within the post itself.

Source

• origin post (2014)

Knowledge Base