Windows 7 end of life -- don’t freak, make a plan

In January 2020, Microsoft will formally end “extended support” for Windows 7. The venerable operating system has served the world well, but its creator will no longer automatically provide security patches, leaving systems running the OS more vulnerable. While this may seem like a crisis, it can be  an opportunity for agencies to both hone their chops for assessing risk and build a plan for managing end-of-life (EOL) events for other products.

Although it is a full 10 years old, Windows 7 still has a huge user base. According to NetMarketShare, Windows 7 holds 37% of the global market for Windows desktop and laptop systems, trailing only Windows 10 in popularity. On the downside, Windows 7 is running on many mission-critical systems, such as many voting machines in the United States. Microsoft has said it will continue to supply security updates to Windows 7 through 2023, but it will no longer automatically patch machines running the OS as a subscription service; that duty will fall on IT and security teams.

For agencies running a voting system or, say, a patient record system on Windows 7, this EOL is can seem quite serious. For most security teams, however, an EOL is a fairly plain-vanilla event that probably kicks off a series of activities designed to mitigate risk. EOLs almost always happen with a wide warning window (in this case, nearly five months) to allow security teams to move crucial activities off the affected platforms or upgrade their hardware to supported operating systems. In the case of the Windows 7 EOL, security teams should develop a four-step comprehensive risk assessment plan -- which can then guide subsequent EOL risk mitigation efforts.

Step 1: Take an inventory of Windows 7 installations. Because an inventory  is basic security hygiene, most agencies probably have one.  If not, this is an opportune time to complete one. Many tools can pull together an inventory, including some that are free like this one from SpiceWorks and others that are open source. Agencies should be sure to include the physical location or the cloud where the system resides.

Step 2: Assess the risks of the Windows 7 systems in the infrastructure. With an inventory of all Windows 7 installations, agencies can  build a standardized risk assessment methodology to identify those most important to protect. A simple but effective method considers four criteria:

• Whether the Windows 7 systems are exposed to the public Internet or are just running in an isolated internal instance. In many cases if a box or device is not connected to the public internet, then risks are markedly lower.
• A detailed understanding of the role and specific tasks each Windows 7 system is used for. Often, the systems will run basic office work. Sometimes, particularly in regulated industries and high-security work where operating systems upgrades tend to lag, Windows 7 might be running sensitive tasks.
• Whether the Windows 7 systems are connected to sensitive data. If a Windows 7 system can directly access databases of customer information, a breach could prove catastrophic.
• Whether a Windows 7 system has privileged status. If, for example, a key sysadmin or member of the information security team is running Windows 7, that constitutes a privileged status risk.

Step 3: Create a risk-rating system and prioritize. From the inventory, agencies can create a simple numerical risk assessment metric they can apply to every impacted system. This can be as simple as applying a numerical value of 1 (low risk) to 4 (high risk) for each of the four previously discussed risk criteria  and adding the four scores together to create a risk rating for each system. Once the Windows 7 systems with the highest risk have been identified, they can be prioritized. Another way to identify the riskiest Windows 7 systems is to use breach-and-attack simulation systems that can automatically probe an entire infrastructure for breach opportunities and highlight where the chinks in the agency's armor reside.

Step 4: Build a clear and simple action plan. The highest quartile risk systems should either be upgraded to a newer Windows system or put on an aggressive internal patching and security program to ensure they are not compromised. The next quartile should be put on a schedule of upgrade and patching, but not before the more critical systems. It’s possible that the lowest quartile of risk can simply be left alone because they pose little risk to the agency.

The upshot of all this? In a perfect world agencies would patch or upgrade everything immediately. But in a world where information security, compliance and IT teams are stretched to the breaking point, covering every EOL 100% with system upgrades is not only impossible but may be unnecessary. An intelligent strategy and plan to inventory, assess and mitigate will make life easier for teams handling EOL events and also ensure that agencies prioritize the right actions as the first actions.