Better late than never: 5 steps to mitigating XP risks

Despite the impending end-of-life date for Windows XP, many agencies have decided to continue using the nearly 13-year-old operating system after it is no longer supported by Microsoft.  Although there was plenty of advance warning, XP remains the second most popular operating system and, according to NetMarketShare, is still used by more than a quarter of all users.

Unfortunately, the end of support for an operating system as popular as Windows XP brings with it very serious security risks with its continued use.  After April 8, unsupported XP systems will no longer be able to receive security updates and patches to any known vulnerabilities. Security experts believe that adversaries have been holding on to the otherwise unknown vulnerabilities for use after April 8 to maximize their potential impact when the operating system will no longer be patched.

Making matters even worse for lingering Windows XP users is the fact that future patches for Windows 7 and Windows 8 will make it easier for attackers to compromise unsupported XP systems because of the architecture and code base shared between Windows XP, Windows 7 and Windows 8. 

When patches are provided for Windows 7 and 8, exploit developers can analyze the patch, reverse-engineer the security updates and then apply what they’ve learned about the vulnerability in the common code base to attack XP.  Ordinarily, attackers have a limited amount of time to exploit vulnerable systems before patches are deployed.  But for future Windows 7/8 vulnerabilities that also apply to unsupported XP systems, this small window of opportunity will turn into an open door for attackers.  Any unsupported Windows XP systems will always remain vulnerable.  As Microsoft stated in its security blog, “Windows XP will essentially have a ‘zero day’ vulnerability forever.”

Understanding the very real security risks associated with the end-of-life of Windows XP is critical.  However, even more critical are the actions and mitigation efforts organizations with Windows XP still in their environment should take immediately. 

1. Upgrade or replace Windows XP systems.  Many organizations are spending more time and resources searching for and implementing other mitigation techniques than it would take to simply upgrade or replace XP systems.  Since all Windows XP systems will eventually need to be retired anyway, most organizations would benefit by investing existing resources in expediting the upgrade.

2. Purchase Custom Support from Microsoft. After April 8, Microsoft will still provide XP security updates and patches – but only for those who are willing to pay a premium via Custom Support through Microsoft’s Premium Services program.  While organizations should make every effort to migrate away from Windows XP as soon as possible, Microsoft’s Custom Support provides the next best alternative for any lingering XP systems.  Custom Support for XP is expected to cost approximately $200 per system for the first year. Although this may seem expensive, it pales in comparison to the likely costs of recovery or harm to brand reputation after an XP-enabled security incident.

3. Isolate XP systems. The only way to completely secure XP systems is to remove all network connections and prevent any access to removable media (the argument can also be extended to remove all users).  Obviously, this would render the system effectively unusable.  One step short of a completely disconnected system is one that is logically or physically isolated to prevent all external Internet communications (i.e., Web browsing and email) and restricting any internal communications to only known and required destinations over specific ports and protocols. 

This could be achieved via a combination of techniques including personal and network firewall rules, router access control lists, proxy restrictions and isolated VLANs.  In all likelihood, the cost of associated architectural changes to isolate vulnerable XP systems may outweigh the cost of simply upgrading; additionally, the systems would be far less functional and still carry a residual risk of compromise and lateral infection via any remaining permitted communications.

4. Prioritize upgrades. Depending on the size of an organization, the enterprisewide upgrade of Windows XP systems may not be a trivial task.  However, the task can be simplified significantly with proper focus and prioritization.  Although it is important to realize that any vulnerable system may be used as a starting point for attacks within an organization, not all systems and users are created equally.  When phasing an upgrade of XP systems, focus first on the most sensitive systems such as those where users have administrative access or connectivity to critical and other highly sensitive systems and data. 

5. Don’t forget Windows XP Mode. Windows XP Mode was included in Windows 7 to make the transition to the new operating system easier.  Unfortunately, the end-of-life of Windows XP makes the use of Windows XP Mode within Windows 7 essentially as dangerous as a separate physical Windows XP system.  Microsoft recommends that after April 8, Windows XP Mode only be used if disconnected from the Internet.  If possible, XP Mode should be disabled entirely if it is not receiving security updates and patches.

Although Microsoft has recently extended its anti-malware support for Windows XP, this will not mitigate the threat of using the unsupported operating system.  If you are lucky, the anti-malware signatures may inform you of an infected system and help to quarantine the malware after the fact.  However, adversaries have been very successful at crafting malware to circumvent detection via signatures, and even Microsoft notes that, “the effectiveness of anti-malware solutions on out-of-support operating systems is limited.”

If you have no other option, the aforementioned actions may help offer some mitigation to the Windows XP end-of-life; however, for those serious about security, you know what you need to do.