That's it exactly. The software was already written to run on XP and the crew trained to use those versions of the software. As long as the ship's hardwired-onl

That's it exactly. The software was already written to run on XP and the crew trained to use those versions of the software. As long as the ship's hardwired-only network is secured from the outside and physical access is limited (disable USB ports, lock down BIOS, locked cabinets, sealed ethernet conduits, etc), you won't have any problems with typical malware and people will have less opportunity to infect systems. Additionally, you can run whitelists to limit what files can even exist on the system or be run. As long as the firewall is strong, network access is restricted to need based, and any servers are fully patched, the various clients on the ship don't need any additional protection from attacks.