The Glade 4.0

How critical is it for individuals, small businesses, churches, etc, to migrate off XP now that it reaches EOL in April? How risky is staying on XP?

Let's put it this way.

Technet lists 1137 security bulletins (which then correspond to a security update that was published) for Windows XP.

So Windows XP averages around 100 security vulnerabilities found and fixed a year since Oct. 2001... and will no longer be fixing them.

Hackers love targeting systems that don't get updated, because they're the ones the vulnerabilities work on. With stuff that's not EOL, hackers have to work on the assumption that only a portion of the systems out there will be vulnerable to a non-zero-day exploit, and the efficacy of a newly found zero-day exploit has a limited window of utility. Come April, 100% of systems will be unpatched for known exploits, and zero-days will last against XP systems forever. So EOL OS's that are still in widespread use get lots of hacker attention, because they're the ideal targets.

_________________
"Aaaah! Emotions are weird!" - Amdee
"... Mirrorshades prevent the forces of normalcy from realizing that one is crazed and possibly dangerous. They are the symbol of the sun-staring visionary, the biker, the rocker, the policeman, and similar outlaws." - Bruce Sterling, preface to Mirrorshades

As someone with an older machine using XP, I am already preparing myself to budget for a new machine and OS. I really don't want, since I have many other things I need to use the moneys for, but 5 or 6 years is probably more than I should have expected out of this machine anyways. I only upgraded small stuff like ram, video, and my PS along the way. My old coreduo from cyberpower has served me really well. With my 4770hd upgrade, it runs WoW (not maxed out) very well still.

Now, gotta explain to my wifey that I need to spend 800ish dollars in a few month on a new rig =)

The biggest risk is if you have to reformat.

_________________

The biggest risk is probably more like having confidential information stolen or exploited resulting in the destruction of your organization because the decision makers are cheap ****.

You know, worst case.

This.

Even if you're an individual.. do you keep any tax records on your computer? Access any email from it -- and receive e-bills? Access electronic banking? Etc.

_________________
"Aaaah! Emotions are weird!" - Amdee
"... Mirrorshades prevent the forces of normalcy from realizing that one is crazed and possibly dangerous. They are the symbol of the sun-staring visionary, the biker, the rocker, the policeman, and similar outlaws." - Bruce Sterling, preface to Mirrorshades

And don't forget online banking,shopping, your personal contact information for family and friends, etc...

You know, just buying Windows 7 or 8 is an option, you don't have to upgrade your computer. I'm running Windows 7 on a computer that's 8 years old and it's actually quite a bit faster than Windows XP. I can understand if you want to get a new computer anyway, and take advantage of Windows being bundled with it, but I just wanted to make sure you're aware of your options.

See, that is kind of what I thought. My question was kind of general sense I didn't want to bias it. But this is specific to the church I go to. There are several machines running XP.

Their I.T. guy is insistent that it isn't an issue and not to bother. He owns his own I.T. company that "manages 1500 systems" and has been in business for years. Someone else on the board at the church has quite a bit of experience and also says not to do it, that it's a waste and not a big deal.

Every bit of research I've done indicates THIS IS A BIG DEAL. So now I'm left baffled. I'm convinced, but people with much more experience in I.T. than me (I'm a software developer, not I.T.) say it's no big deal.

Does the guy who manages the systems for the church get paid to do it, or not?

_________________
"Aaaah! Emotions are weird!" - Amdee
"... Mirrorshades prevent the forces of normalcy from realizing that one is crazed and possibly dangerous. They are the symbol of the sun-staring visionary, the biker, the rocker, the policeman, and similar outlaws." - Bruce Sterling, preface to Mirrorshades

That's because you have to understand that most IT people have zilch in the way of security consciousness.

_________________

Owning a company doesn't make you a master of its operations. My boss doesn't know **** about day to day web development work but he's great at marketing. Just because this guy walks past a server farm or something when he goes to work doesn't mean he could run any of it without his staff. Anyone that says any software is not worth updating shouldn't be allowed to make security decisions. We run niche websites on a platform that gets updated monthly and I still need to deal with the occasional SQL injection or whatever. If you have vulnerabilities then someone is going to exploit them, and if the security hole is big enough you may never even realize that anything is wrong.

Yes, he does get paid. He's not a member of the church or anything, he is just the owner of the I.T. company that they hired.

He needs to be dismissed with prejudice

Seriously this goes beyond security, if you have to reformat how do you get from clean install to SP3 + updated drivers for all your sheez? It is hard enough with Microsoft providing updates for XP today, let alone when they shut that off.

_________________

Upgrade to Windows 7. My Department finally did because of the EOL coming around and the security issues involved. They are seriously cheap about this stuff. Heck, they even upgraded to IE9, which wasn't as good as I had hoped but better than I expected.

_________________
The U. S. Constitution doesn't guarantee happiness, only the pursuit of it. You have to catch up with it yourself. B. Franklin

"A mind needs books like a sword needs a whetstone." -- Tyrion Lannister, A Game of Thrones

I'd say it depends on the role these systems play.

"Not connected to the internet, used for a proprietary app, re-imaged from ghost regularly" isn't as serious an issue as "mission critical".

That doesn't mean it's not serious, just means it's less serious.

I don't plan, for instance, to upgrade the XP image on my personal VMs. They're stand alone systems, basically just set up to serve as a backup container for the docs/apps I have in whatever ancient file format they were created in, like Illustrator or PageMaker. 10 year old crap, but recently I went back in to get data from it, so I can't say its useless.

_________________
In time, this too shall pass.

They are used for various purposes. Email, web, MS Office, etc. In other words, ripe for infection. And of course they have access to the shared drive on the server.

Well if they can't shell out a few hundred dollars for some Windows licenses, maybe the pastor can just pray to keep the malware away.

It is more than a few hundred dollars. All told it will cost in the neighborhood of $8k. That includes the licenses, some HW updates needed to run 7 (mostly video cards), and then there are some that are so old they have no hope of running 7 and would need to be replaced.

So that's not chump change. And they've got their I.T. guy saying don't bother, while I'm over here saying they're wrong, and this is a big deal.

Is this guy the same person who is hired to fix your church's computers is they get infected with malware?

It sounds to me like he's trying to take a group of underinformed churchgoers for a ride. Right now it looks like he's saving you a ton of money. You'll be so pleased with all the money he just saved you that you'll be happy to hire him to clean up your computers when they get infected.

_________________
Buckle your pants or they might fall down.

What is the integrity of the overall computer environment? Is data being backed up? Stored securely?

I also wonder if he is accountable/responsible in any way for costs associated with data loss, compromise, etc...

If cash is an issue, go Linux, but don't stay on an unsupported OS.

_________________
In time, this too shall pass.

_________________

Scheduled backup with onsite and offsite backup. There's a firewall AVHIDS, etc.