The biggest problem the PCI SSC had with deprecating old TLS versions was the sheer number of devices running XP Embedded (which doesn’t support newer TLS versi

The biggest problem the PCI SSC had with deprecating old TLS versions was the sheer number of devices running XP Embedded (which doesn’t support newer TLS versions). It was THE operating system for point of sale devices for a very long time, and replacing or upgrading these devices was a very complicated and expensive process for a lot of organisations. I haven’t worked with PCI for a couple of years, so I’m not sure where they got to. But that was the main issue that kept getting the depreciation deadlines pushed back. The ubiquity of that operating system was an issue in lots of other industries too. I worked in a place recently that had a large industrial robotics system, all of it was running on XP Embedded, and the most feasible approach they came up with for addresses the security issues created by that was to implement increasingly more strict network segmentation controls for their robots. I know it was also running on a fair amount of military hardware too (maybe still is? I have no idea), I don’t think you’ll find many helpful Stack Overflow threads for how to upgrade your Lockheed AC-130 from Windows XP…