Microsoft issues its final security update this week for Windows XP, the 13-year-old operating system that remains the second most used platform in the world despite the certainty that after April 8 it will rapidly become dangerously insecure.
Here is a set of questions and answers that help to explain this phenomenon and to offer some advice for those still using XP.
+[Also on Network World: 9 must-do's if you must stick with Windows XP | Windows 7, XP vulnerabilities rose in 2013 | China's unsupported XP machines hold the potential to become a massive botnet army ]+
What's the big deal?
When Microsoft stops supporting XP criminals will keep on finding new ways to exploit the operating system. The list of unpatched exploits will grow and grow to the point that compromising XP machines will be elementary for hackers. Data on XP machines will be at risk. XP machines on networks will become launch pads for internal attacks against better supported machines. They could easily be recruited into botnets to launch coordinated DDoS attacks or massive spamming.
Will XP machines stop working?
No.
Why is Microsoft doing this?
Microsoft publishes a lifecycle for all its operating systems; all of them eventually reach end of support, and end of support is announced literally years ahead of time. As operating systems age, they fall behind in their native security features and are unable to take full advantage of more advanced hardware. Using some internal calculus, Microsoft decides on what the best time is for end of support for each of its products.
How many machines still run Windows XP?
Hundreds of millions. One estimate by StatCounter says that for the month of March, 17.16% of Internet-connected computers in the world ran XP. In businesses, Gartner estimates that up to a quarter of enterprise computers will still run XP and that a third of business networks will continue to run XP on more than 10% of their machines. Qualys estimates that the overall 10% of business computers still run XP.
What's wrong with people that they didn't upgrade?
Some people just procrastinate inexplicably but others have good reasons. Cost is a factor. Upgrading can involve buying new hardware, time and money to transfer files. Some business-critical software won't support newer operating systems and the cost of rewriting the software is prohibitive. XP is the operating system for some manufacturing machines necessary to businesses, and the makers of these machines haven't made any provision for upgrades.
What about automated teller machines? Are they safe?
It depends. Since it's estimated that 95% of ATMs still run XP, potential danger is there. If banks pay for extended support, they shouldn't be any more susceptible to attacks than they were before. These machines might connect only to private networks, which makes them easier to defend than if they are exposed to the public Internet. It makes sense that banks would have been working out what do to given that widespread breaches due to unsupported XP would be disastrous for their business.
Why doesn't everybody just buy the extended support?
It's not that easy and it costs a lot. One report says the support costs $200 per desktop per year for the first two years and $800 per desktop for a third year. The U.K. government is paying the equivalent of $9.13 million for one year of extended support for more than 85,000 computers. In order to get the deal, the government had to show a plan for migrating away from the operating system.
What can I do to use Windows XP safely?
Safety is relative, but there are measures that help. Get a supported browser (Firefox, Chrome) other than Internet Explorer - the version supported by XP is no longer supported. Allow only white-listed applications to run on the machines. Isolate XP machines on networks. Patch apps such as Microsoft Office so they represent less of a threat or a target. Use updated firewalls and anti-virus software. More here.
Why wasn't there a big crisis with end of support for Windows 95, Windows 98, etc.?
Back then Microsoft had been successfully migrating customers to newer versions of its operating system so there were many fewer machines losing support all at once.
What's so great about XP?
Windows XP has been exceptionally popular, stable, and is bought and paid for. A contributing factor may be that XPs successor Windows Vista was such a disaster that customers wanted to leave well enough alone by sticking with XP even after the very popular Windows 7 came out.
Tim Greene covers Microsoft and unified communications for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter @Tim_Greene.
Read more about software in Network World's Software section.