Out-Law News 2 min. read

Consultancy warns of security risk to businesses if they do not migrate away from Windows XP


A fifth of UK firms that use Microsoft's Windows XP operating system will continue to use the software even after Microsoft stops providing security patches for the technology a year from now, according to a new survey.

In 2010 Microsoft confirmed that it would end "extended support" for Windows XP and Office 2003 on 8 April 2014. However, UK consultancy firm Camwood said it was "worrying" that a 40% of respondents to a survey it commissioned had said that their companies had "yet to even start migrating off XP" and said it was "even more shocking" that 20% of respondents were not planning to do so at all.

"Senior management in those organisations that have yet to start migrating may not fully understand or appreciate the level to which unsupported and unpatched environments are vulnerable to security risks," Camwood said in a new report. "These risks may result in an officially recognised control failure by an internal or external audit body. This can lead to suspension of certifications, and/or public notification of the organisation’s inability to maintain its systems and customer information."

"In truth, it’s almost not worth speculating about too much," it added. "The variety of ways that exploits can cause trouble for a company through affecting its data are almost limitless. The bottom line is that, after XP support is withdrawn, businesses will not be fully protected."

Camwood had commissioned a study to gather the views of 250 chief information officers, chief technology officers, IT directors and IT managers at companies with more than 2,000 employees.

More than a fifth of the IT decision makers whose companies use Windows XP said that they had yet to be asked by their company to move away from Windows XP. (registration required for 17-page / 520KB PDF) However, analyst group IDC said that those that do not migrate will "not only [be] leaving themselves exposed to security risks and support challenges" but would also be "wasting budget dollars that would be better used in modernising their IT investments", the Camwood report said.

It would generally take businesses between 18 and 32 months to migrate from Windows XP to another operating system, Camwood said. Companies that have not begun their migration yet are therefore "exposing themselves to serious business risks", it said.

Businesses should draw up a costed plan for migration, ensure there is "buy-in" from across departments to the migration and should then give "primary consideration" as to whether users within the firm "have the right tools to be productive" under new systems, Camwood said. It said that 10% of firms have a "fully managed" corporate applications store that employees can access, whilst 86% of IT decision makers said that they planned to move at least part of their IT infrastructure into the cloud.

Camwood said that although businesses could pay Microsoft for "custom support" services for Windows XP after 8 April 2014, it said it had been estimated that this could cost firms between $200,000 and $500,000 a year.

Windows XP is currently the second most popular operating system in the desktop operating system market, commanding a 38.73% share of that market, according to the Net Market Share website.

We are processing your request. \n Thank you for your patience. An error occurred. This could be due to inactivity on the page - please try again.