5 ms·

> The remaining XP machines are still in place due to complex technical requirements from a small number of externally provided highly specialised applications,

> The remaining XP machines are still in place due to complex technical requirements from a small number of externally provided highly specialised applications," a spokeswoman told the BBC. This is the real heart of the issue. In my (very limited) experience, software choices are made by different people than the ones that deal with them each day. My hope is that more and more applications will become web based, and big enterprises can move to a cut down linux desktop with a limited attack surface, so internal IT teams can focus more on securing servers.

rlpb 9y ago
At a higher level, I think the problem is poor requirements specifications when the externally sourced applications were first procured. If the procurers had accurately predicted the lifetime requirement, they could have required the stack to be fully security supported for that length of time, making it the vendor's problem to update to a newer OS that has security updates. Instead, they pushed the cost back while keeping the risk themselves. Perhaps back then this wasn't so obvious. I hope it is now, and procurement teams actually do incorporate this into their requirements now.
- grecy 9y ago
  > If the procurers had accurately predicted the lifetime requirement, they could have required the stack to be fully security supported for that length of time, making it the vendor's problem to update to a newer OS that has security updates. Oh sure, but there are a million other reasons too. Maybe the vendor went out of business, but company is still using whatever application for edge cases. Maybe the vendor now has Version 2.0 of application that does support newer OSs, but it requires hundreds of millions in hardware upgrades. Maybe it simply takes years and tens of millions to test every application and piece of hardware used by the company to see how they handle new OS. (I worked for a large company that just recently upgraded from XP to Win 7, and the project was years and tens of millions over budget)
  - stupidcar 9y ago
    It's 2017, not 1997. None of these issues should be any surprise to a large organisation's IT department. It's professional negligence to allow the situation to devolve to the point that such huge, expensive projects are required to upgrade everything, or the business is relying on a single outside software vendor for an important function. IT departments should have complete visibility of all their hardware and software assets. They should have rolling programmes of upgrades for both hardware and software, and they should understand exactly how long these will take, so that they do not overrun an OS end-of-life. They should have contingency plans for deprecating or replacing software if a vendor goes out of business. Failure to do the above is equivalent to a facilities department not doing essential maintenance, or forgoing safety checks, or a compliance department ignoring legal requirements. That fact that something costs money, or involves IT, does not magically excuse incompetence, shortsightedness or ignorance.
    - walshemj 9y ago
      The uk police have faced massive cuts year on year so probably don't have the budget and have lost a lot of in house knowledge
      - Nexxxeh 9y ago
        Absolutely this. Our Prime Minister (by default), Theresa May, used to be our home secretary. She seems technically illiterate. Unfortunately the base she appeals to is also relatively... Ignorant... Of tech issues and of the real world. If it won't play well in The Daily Mail, it's not a priority. According to people in the know, there aren't enough police in the community, and there aren't enough armed police, and there's not enough money going into the police force. This has all been brought into sharp focus by the recent terror attacks. Her actions read like a bad conspiracy theory.
        dx034 9y ago
        Even if you have a tech literate home secretary that won't help you much. Telling the public that police presence has to be reduced because the police needs to upgrade to Windows 10/Linux can cost you the next election. Especially in times when people are very concerned about the security situation.
- vetinari 9y ago
  Often, the application is supported, however the procuring organization has meanwhile opted out of maintenance in order to cut costs, which takes the updated releases out of reach. Another scenario is, that the organization pays maintenance, new release supporting new OS is available, but upgrading both involves costs (in updating, migrating, documenting, testing), that the organization is not willing to take and just carries on with the old releases.
jlebrech 9y ago
they should install some VMS for those specialised applications, this would also have the additional benefit of snapshotting.
- rbanffy 9y ago
  It's not always possible with specialized hardware whose drivers are not even properly documented. Of course, mandating blob-free open-source for all government purchases would have solved this mess right at the start. The only reason it's not mandated now is that some vendors would be excluded for being unable or unwilling to comply.
dx034 9y ago
The problem is that you'd want to have desktop apps for some parts and you'd then probably end up with some Electron app which looks nice but is slower than a 20yr old programme with the same function. Esp where hardware needs to be integrated (e.g. taking fingerprints), I imagine it's not easy to create platform independent applications.

rlpb 9y ago

At a higher level, I think the problem is poor requirements specifications when the externally sourced applications were first procured. If the procurers had accurately predicted the lifetime requirement, they could have required the stack to be fully security supported for that length of time, making it the vendor's problem to update to a newer OS that has security updates. Instead, they pushed the cost back while keeping the risk themselves. Perhaps back then this wasn't so obvious. I hope it is now, and procurement teams actually do incorporate this into their requirements now.

grecy 9y ago
> If the procurers had accurately predicted the lifetime requirement, they could have required the stack to be fully security supported for that length of time, making it the vendor's problem to update to a newer OS that has security updates. Oh sure, but there are a million other reasons too. Maybe the vendor went out of business, but company is still using whatever application for edge cases. Maybe the vendor now has Version 2.0 of application that does support newer OSs, but it requires hundreds of millions in hardware upgrades. Maybe it simply takes years and tens of millions to test every application and piece of hardware used by the company to see how they handle new OS. (I worked for a large company that just recently upgraded from XP to Win 7, and the project was years and tens of millions over budget)
- stupidcar 9y ago
  It's 2017, not 1997. None of these issues should be any surprise to a large organisation's IT department. It's professional negligence to allow the situation to devolve to the point that such huge, expensive projects are required to upgrade everything, or the business is relying on a single outside software vendor for an important function. IT departments should have complete visibility of all their hardware and software assets. They should have rolling programmes of upgrades for both hardware and software, and they should understand exactly how long these will take, so that they do not overrun an OS end-of-life. They should have contingency plans for deprecating or replacing software if a vendor goes out of business. Failure to do the above is equivalent to a facilities department not doing essential maintenance, or forgoing safety checks, or a compliance department ignoring legal requirements. That fact that something costs money, or involves IT, does not magically excuse incompetence, shortsightedness or ignorance.
  - walshemj 9y ago
    The uk police have faced massive cuts year on year so probably don't have the budget and have lost a lot of in house knowledge
    - Nexxxeh 9y ago
      Absolutely this. Our Prime Minister (by default), Theresa May, used to be our home secretary. She seems technically illiterate. Unfortunately the base she appeals to is also relatively... Ignorant... Of tech issues and of the real world. If it won't play well in The Daily Mail, it's not a priority. According to people in the know, there aren't enough police in the community, and there aren't enough armed police, and there's not enough money going into the police force. This has all been brought into sharp focus by the recent terror attacks. Her actions read like a bad conspiracy theory.
      - dx034 9y ago
        Even if you have a tech literate home secretary that won't help you much. Telling the public that police presence has to be reduced because the police needs to upgrade to Windows 10/Linux can cost you the next election. Especially in times when people are very concerned about the security situation.
vetinari 9y ago
Often, the application is supported, however the procuring organization has meanwhile opted out of maintenance in order to cut costs, which takes the updated releases out of reach. Another scenario is, that the organization pays maintenance, new release supporting new OS is available, but upgrading both involves costs (in updating, migrating, documenting, testing), that the organization is not willing to take and just carries on with the old releases.

jlebrech 9y ago

they should install some VMS for those specialised applications, this would also have the additional benefit of snapshotting.

rbanffy 9y ago
It's not always possible with specialized hardware whose drivers are not even properly documented. Of course, mandating blob-free open-source for all government purchases would have solved this mess right at the start. The only reason it's not mandated now is that some vendors would be excluded for being unable or unwilling to comply.

dx034 9y ago

The problem is that you'd want to have desktop apps for some parts and you'd then probably end up with some Electron app which looks nice but is slower than a 20yr old programme with the same function. Esp where hardware needs to be integrated (e.g. taking fingerprints), I imagine it's not easy to create platform independent applications.