Why Hackers Love Companies Running Unsupported Software
Key Points in This Article:
- Businesses and organizations running unsupported software are more vulnerable to cyberattacks than current applications.
- Outdated software – and hardware – lacks the latest security features, making them enticing targets for hackers.
- Using supported and up-to-date software and hardware as part of a comprehensive cybersecurity plan is critical.
When your device is compromised, threat actors will start to map out your IT infrastructure to find the servers with the biggest payload. To do this, they’ll seek jump points. Jump points are devices they can use to gain access to targeted servers. And typically, they’ll find these jump points in unsupported software and hardware. Companies with devices running unsupported software are vulnerable to malware, ransomware attacks, and more. That’s why all companies must run supported software as part of a comprehensive cybersecurity plan.
What Is Supported Software?
Every year, leading enterprise software providers, such as Microsoft, Oracle, and Salesforce, announce plans to retire older software applications. Doing so allows them to focus on selling and supporting newer applications. But it also means that software companies will no longer release improvements and patches for older software. Nor will they provide customer service support for users of old software.
Typically, they’ll announce a future date at which the software will reach an End of Life date and an End of Support date. The End of Life date is when the company will stop manufacturing and selling the software. The company may have introduced a new generation of this software or integrated its features into a different application they are now promoting for sale. They will still provide technical support to the old software’s users during this period. However, they will likely limit any new updates to essential security patches during this period.
When the software reaches the End of Support Date, the company will cease offering updates, including security patches. They will no longer offer technical support to customers either. By doing so, they hope to prod business customers to buy the newer software version, which offers new features and customer support. But some companies do not upgrade their software applications at this time.
Companies that use unsupported software may do so for several reasons. They may not be able to afford the cost of the new software. Or they may not prioritize spending on it. Sometimes, business leaders may not understand the dangers of running unsupported software. And while they have the money to spend, they may not take the time and effort to upgrade their organization’s devices.
The Dangers of Running Unsupported Software
However, companies that choose not to obtain and run current software applications put themselves at heightened risk of a cyber attack. Hackers will continue to scour old software applications for vulnerabilities. But without software developers continuing to develop security patches and upgrades, it’s up to the customers themselves to do so. More often than not, they don’t have the time or expertise to do so.
Further, outdated software can develop problems of its own. When the software developers no longer release updates to address bugs, old software applications may stop functioning as intended. Integrating old, buggy software with other software applications may be difficult or impossible. In some cases, the unsupported software may stop functioning entirely.
With very old software, you run the risk of being able to run it at all on newer hardware and operating systems. For example, many leading hardware manufacturers produce devices with Trusted Platform Module (TPM) chips, the latest versions of which will not run many retired enterprise software applications. You could waste money running old software and buying newer devices. Even if you can run old software on newer devices, you’re at elevated risk for system malfunctions and failures. You could suffer downtime, business disruption, and even data loss if you continue to run outdated software.
But beyond basic functionality, the biggest challenge is that outdated software represents a potential-jump point, allowing hackers to penetrate your most critical IT assets. And in some cases, running unsupported software may be considered a form of negligence. In some industries and markets, companies are required to take robust action to protect sensitive data. In the event of a successful cyberattack, you may be legally liable for negligence as you failed to take the necessary steps to protect customer, employee, financial, and other important data.
What About Hardware?
It’s not just the software you have to be concerned with. Outdated hardware comes with the same risks as outdated software. Unsupported hardware is more prone to crashes, compatibility issues, downtime, and increased maintenance time and costs. When you can’t rely on the manufacturer o service your equipment, you have to handle maintenance and repairs yourself, which can be challenging, especially for small businesses.
Unsupported hardware can also pose a serious cybersecurity threat. Frequently, you can’t access new software security features with old hardware. Further, old hardware lacks newer security design features and is inherently less secure. And some hardware has been found to have exploitable backdoors in their firmware that help hackers gain access. During manufacturing, these backdoors were planted by criminals and can be nearly impossible to identify or remove. When hardware is still supported, manufacturers can warn customers if they’ve learned these backdoors, recall and repair devices, or replace them. But once a model has been retired, manufacturers won’t be nearly as vigilant about doing so.
So it’s critical that not only are you running only supported software. Your business must ensure that all of your hardware is up-to-date as well. It may be expensive to do so, but a cyberattack’s financial, legal, and reputational costs are exponentially greater.
Keeping Your IT Current
Ensuring you’re running nothing but supported software is easier than it sounds. It’s not just a matter of buying the latest licenses. Chances are your organization is running unsupported software on devices you’re unaware of, and you have critical business processes supported by this software.
It’s critical to conduct a thorough inventory of all of your devices and applications. And when you find devices filled with unsupported software, back up the data on them, get them off your network, and place them in isolation. By placing them in isolation, you’ve removed the possibility they can be used to jump to a more critical spot in your infrastructure.
Make sure you’re not only running supported software but that also all of your software and firmware is up-to-date. Most software application updates occur automatically, but not all of them. And many firmware updates require manual downloads. You must check to ensure you’re running the latest software and firmware versions to strengthen your IT security.
