If it works, it works…?

Old technology solutions – every organization has a few of them
tucked away somewhere.

It could be an old and unsupported storage system or a tape
library holding the still-functional backups from over 10 years
ago.

This is a common scenario with software too. For example,
consider an accounting software suite that was extremely expensive
when it was purchased. If the vendor eventually went under, then
there’s no longer any support for the software – which means that
the accounting solution only works on some older operating system
that isn’t supplied with updates either.

How valuable is it to ^[1]? Well, organizations
don’t enjoy running old legacy systems just for the pleasure of it,
but they’re often forced to keep them running because it’s their
only option, or at least the only cost-effective option available
to them.

If it works, it works…?

From a purely functional perspective, there is usually no
problem with old technology. Yes, the technology is outdated, but
it can still fulfill its role perfectly adequately. Companies
continue to use old physical equipment because, after all, that old
storage system is still accessible and the tapes can be read when
needed. It just works – and it’s been working well for a long
time.

The same goes for old software. The software might be outdated,
but accounting manages all the invoices and payables using the old
software with no issues at all. What’s more, anecdotally anyway,
older hardware lasts longer than more modern counterparts. Remember
grandma’s old fridge that lasted 40 years? Yours will have a good
run if it lasts 10 years.

The same thing applies to IT, but for different reasons. New
hardware is more complex and thus has more breakable parts than
older generations. But there is a different risk that’s inherent to
older hardware: it is commonly no longer supported by new operating
systems, which means that running end-of-life operating systems is
the only way to keep those old workhorses running.

The argument for replacement

So, why the eagerness to update everything if older systems do,
in fact, work that well?

During election season “it’s the economy, stupid.” In the IT
world, on the other hand, “it’s security, stupid.” Old systems are
intrinsically unsecure. New vulnerabilities that affect old systems
still pop up all the time, but there are no fresh updates for these
end-of-life systems that protect against those new threats.

This introduces complicated consequences beyond just
cybersecurity. For example, companies that run unsupported systems
can be in breach of compliance requirements because it’s impossible
to meet compliance metrics for timely patching of vulnerabilities
when patches are never released in the first place.

Companies have tried many approaches to bridge the gap between
the need to keep legacy systems running and the fact that there’s a
lack of updates for those systems. It creates a headache for IT
practitioners, who have tried everything from air gapping systems
to hiding systems behind multiple network-level security layers and
implementing restrictive access controls around them.

Fortunately, there’s an alternative

All the options we’ve mentioned impact the regular use of a
system, which creates its own set of challenges. The bravest (or
less security conscious) IT teams will simply cross their fingers
and not do anything at all, hoping for the best.

But let’s step back for a moment. What’s the real problem with
running older, end-of-life systems?

It’s simple: it’s the lack of available security updates. The
system is running fine and it’s valuable exactly because it is
running as is. The only thing missing is timely security
updates.

If we can find a way to apply security updates to an end-of-life
system, then running that system is just the same as running an
operating system launched last week – because the system fulfills
its intended purpose and it does so securely.

Thankfully, ^[2], and you can add it to
unsupported systems. One option, for example, is subscribing to
extended support from OS vendors who provide an extension on the
period during which patches are available for their operating
system version. This type of solution isn’t always implemented when
it would be the most useful, however, because it can be
expensive.

Affordable extended support

If the story we described sounds familiar or if you rely on
older systems as part of your IT infrastructure, and you want to
know more about keeping them secure, TuxCare can help.

At ^[3], we provide ^[4], without all the extras,
at a sensible price. Thanks to TuxCare, you can now solve the issue
and keep your valuable systems running as securely as any others,
until such a time when it’s appropriate to move the workload
elsewhere.

Need to buy yourself some time to migrate to a supported OS
while still securely running an outdated system, all while
receiving security updates? Check out ^[5]

This article is written and sponsored by , the industry leader
in enterprise-grade . TuxCare
offers unrivaled levels of efficiency for developers, IT security
managers, and
seeking to affordably enhance and simplify their cybersecurity
operations. TuxCare’s Linux kernel live security patching, and
standard and
assist in securing and supporting over one million production
workloads.^[6][7][8][9]