Transfer end-of-Windows support experience sharing

MicrosoftWindows Server 2003 will end its support this July, and many companies are trying to move to a new platform to avoid vulnerability attacks. For many companies, however, it is a particularly daunting challenge to complete the transfer within the time frame, based on human, financial and other factors.

In the process of helping our clients transfer, we also see our clients ' unique insights on the recent termination of support, so we share them with you (of course, if customers are not ready to transfer before July 14, we can help them protect Windows Server 2003, and can also protect Windows Server2012 and new Windows platforms like Azure. We visited University's Florida Health Shands Medical Center's information security manager, Tim Nance, to listen to their experience in transferring Windows XP. With approximately 18,000 desktops and 1,400 servers (900 of which are VMware), the Ufhealth Shands is faced with a rather difficult task. Here are some of their transfer experiences:

Trend Micro: How much problem does your organization face in ending the protection of the support platform? How does this affect your organization in terms of preparation?

Timnance: Our people responsible for Windows XP transfer were not seriously implemented in 2013 and 2014, until very late. We have thousands of machines on the platform, although we have been urging the end date to come, but they do not seem to realize that things are about to happen, then the university Department of the competent units under a command, all the use of XP machines must be offline, until then there is a lot of manpower transfer work. They hired some people to upgrade, but they still knew they couldn't do it within the time frame.

At this point we began to consider the use of Trend Micro intrusion prevention firewalls (now known as Trend Micro Vulnerability Protection) to solve this problem. We have deployed policies on all machines that use windowsxp to solve temporary problems until we find a permanent solution. We had a lot of expensive machines, but luckily Vulnerabilityprotection bought us some time.

Trend Micro: How does your organization use virtual patching technology to help with the transfer?

Timnance: We use Trend Micro to deploy virtual patching technology, to provide our Windows XP devices with a temporary solution, extend their service life, let us gradually reduce the number of such devices, the original transfer time is 10 months, after the virtual patching, We can finish it within 6-7 months. In some cases, the filtering rules will be too much to affect the performance of the equipment, but only the single operation of the equipment should be able to sustain a year to 1.5, for us to win a lot of time. We were already a trend Micro customer, so we know that this product should suit us.

Trend Micro: What is your primary strategy for transferring Windows XP ?

Timnance: These machines were all transferred to Windows 7, and in addition, some VDI terminals and licenses were established. The original goal was to complete the transfer within three to 6-7 months, but within the first month the key equipment in the United States region had been transferred. There are still hundreds of Windows XP remaining that cannot be transferred because they need to perform some specific applications that cannot operate on the new Microsoft operating system. For these machines, we will continue to address security issues through virtual patching, or procure hardware firewalls to protect these devices.

For example, we have a pathological device for experimental analysis, which costs $ $175,000 to replace the machine, and the new machine does not provide more diagnostic items, rather than spending $ A $ $ to use a hardware firewall to protect more cost-effective.

Without the use of virtual patching technology, we are sure to have some business disruption. In an environment that requires 24 hours of operation, we are not able to directly downline 300 machines, we have only 48-50 Field Service personnel, and we do not have enough time to change the operating system of all machines in the field, and also to maintain smooth operation. Virtual patching allows us to extend the lifespan of these devices and keep us up and running.

Trend Micro: Does your organization have any immediate regulatory compliance requirements as the support termination date is near?

Timnance: We're not worried about compliance, but we want to look at the security and risk perspective and what's best for us. What we are most concerned about is the vulnerability problem. Security experts have pointed out that hackers are ready to launch a zero-point attack on the day of support termination. Once Microsoft no longer provides patches, it is likely that a large-scale data attack will occur, so our most important task is to prevent such threats.

Trend Micro: What do you learn from the experience of transferring your organization from Windows XP ?

Timnance: We are really ahead of schedule and we expect to be able to complete the transfer three months before XP terminates support (except for devices that cannot be transferred). One of the things I've learned is that if you can draw up plans and strategies, deep Security can help you get more time if you don't have enough manpower to complete the transfer as quickly as possible.

Transfer end-of-Windows support experience sharing