End of Microsoft Support for Windows XP

Jan 31, 2014 | Alerts, General Interest, Managed Services, Productivity, Security, Updates, Windows XP

The Federal Financial Institutions Examination Council agencies have issued the following statement for financial institutions about the end of support for Windows XP and regulatory guidance for addressing the risk from its continued use.

PURPOSE

The Federal Financial Institutions Examination Council (FFIEC) agencies (“agencies”) are jointly issuing this statement to alert financial institutions that the discontinuation of support for the Microsoft Windows XP operating system (XP) could present operational risks to financial institutions, technology service providers (TSPs), and to activities supported by other third parties. The agencies expect financial institutions and TSPs to identify, assess, and manage these risks to ensure that safety, soundness, and the ability to deliver products and services are not compromised.

BACKGROUND

Microsoft will discontinue extended support for XP effective April 8, 2014. After this date, Microsoft will no longer provide regular security patches, technical assistance, or support for XP. Financial institutions, TSPs, and other third parties that use XP in personal computers, servers, and purpose-built devices such as automated teller machines (ATM), or that are dependent on applications that require use of XP could be exposed to increased operational risk.

POTENTIAL PROBLEMS

Potential problems include degradation in the delivery of various products and services, application incompatibilities, and increased potential for data theft and unauthorized additions, deletions, and changes of data. Additionally, financial institutions and TSPs that are subject to the requirements of the Payment Card Industry Data Security Standard (PCI DSS) and continue to use XP after April 8, 2014, may no longer be compliant.

REGULATORY GUIDANCE

Financial institutions and TSPs that use XP should follow their risk management processes to address the risk from the continued use of XP, consistent with the risk management guidance contained in the FFIEC Information Technology (IT) Examination Handbook.

Important considerations include

  • [list style=”bullet”][li]performing risk assessments: Identify and measure the risk from the continued use of XP throughout the organization and at third parties, including business continuity and disaster recovery situations.[/li][li]selecting appropriate mitigations: Consider costs and potential risks, including compatibility with other systems and applications, in selecting a mitigation strategy.[/li][li]conducting appropriate planning: Develop an implementation plan addressing priorities for changes, ensuring appropriate change management procedures, and monitoring related third parties’ mitigation and migration activities, as warranted.[/li][li]monitoring and reporting: Monitor the risk mitigation implementation to ensure that the level of risk is acceptable. The effectiveness of controls should be tested periodically and results reported to senior management or a committee of the board of directors, as appropriate, to ensure risk continues to be managed.[/li] [/list]

Recent Posts

Co-managed IT Services Use Cases

Co-managed IT Services Use Cases

As businesses become increasingly reliant on technology, many are turning to co-managed IT services as a way to maximize their efficiency and get the most out of their tech investments. Co-managed IT is an arrangement in which a company utilizes both an internal IT...

How an MSP Can Support a Remote Team

How an MSP Can Support a Remote Team

The migration to remote work in recent years has highlighted the need for organizations to have a reliable managed service provider (MSP) that can provide comprehensive support. Here are some of the ways an MSP can help your remote team:   Security Security is...

Co-Managed IT Services for Law Firms

Co-Managed IT Services for Law Firms

Co-managed IT service is a type of IT service delivery model where the responsibilities for managing, monitoring, and supporting an organization’s IT infrastructure are shared between the internal IT staff of the company and an external managed service provider (MSP)....

Use Cases for Co-Managed IT Services

Use Cases for Co-Managed IT Services

Meeting the IT needs of a business using internal resources can be difficult and expensive. Meanwhile, outsourcing IT services may prompt questions about control and security. One of the ways the market has evolved is through Co-Managed IT Services, which provide a...

The Tempo of Cybersecurity

The Tempo of Cybersecurity

You are probably thinking to yourself, “oh great, another cybersecurity article”. I feel the same way sometimes, that I’ve become numb to the statistics, and I just want to go back to a time when we didn’t have to consider unscrupulous threat actors trying to take...