When software reaches end of life, what’s your plan?

When software reaches end of life, support costs and cyber risks drastically increase as vendors discontinue patches and updates. Too often, software EOL doesn’t receive the planning that it deserves, and risks that should be easily avoided are unintentionally left in the environment. 

Take Adobe Flash Player as an example. At the height of its popularity, the software was installed on nearly 1 billion endpoints. That number has dwindled over the years with an increased reliance on HTML5 to deliver animation and interactive content. In December 2020, more than two decades after the software was created and released, Adobe announced the EOL for Flash, and with it, the end of distribution, support and security updates. Without support, this once popular software with over a 1,000 known vulnerabilities could spell trouble for years to come.

EOL can increase agency security risk

Without patches and updates from the vendor, agencies’ endpoints can be left open to both critical and non-critical vulnerabilities. When software is no longer supported by the vendor, everyone knows about it. EOL can be a dream come true for a bad actor and a nightmare for a government organizations. While agencies struggle to sunset the software, attackers can leverage vulnerabilities -- which won’t be patched after EOL -- to gain entry to the organization’s network and launch an attack, threaten to expose data or hold it for ransom, sell sensitive information to foreign countries or take any number of other malicious actions that could be damaging to not just the agency, but to national security as well.

Plan for the inevitable, even if it’s 20 years away

Few agency IT teams plan ahead for software EOL, especially for software like Flash, which had been in use for so long. Because the federal procurement process is often lengthy, getting a replacement isn’t always a rapid exercise That means that when it comes time to replace an EOL application or tool, agencies can spend months or years gaining approvals, negotiating contracts, installing new applications and ensuring the safe removal of old software. 

Every vendor is different, but many will announce EOL at least 12 months ahead of the official sunset. In the case of Adobe Flash, EOL was announced mid-2017, giving agencies more than three years to prepare. Even with advance notice, however, any EOL event can be disruptive. User familiarity with a tool can present cultural or organizational adoption challenges, and processes that require the use of the expiring tool may temporarily cease to run as expected or run in a degraded manner. Those disruptions may impact the mission and business, and it may also mean that some users continue to use the tool if it remains installed beyond EOL. 

EOL isn’t just about getting rid of the old software -- it’s also about improving agency security. Malware creators are particularly interested in commonly used software that is EOL because they know that not only will the vendor no longer make patches and updates available, but there will be a significant number of organizations that are slow to sunset the software and move to another tool or platform. Attackers will aggressively target systems running old software the moment the opportunity presents itself.

Actually sunsetting an application after it has reached EOL is hard enough when agencies know they have the software installed; but, in many cases, organizations do not even realize that they have the software running on their networks. Adobe Flash, for example, is often embedded deep within critical systems, making it hard to identify, much less uninstall. And, even if each individual installation can be identified, the size, complexity and reliance of that particular software on other systems can make it even harder to uninstall -- at least without bringing the mission or business to a screeching halt. 

It’s important that whenever a vendor makes an EOL announcement, those responsible for security as well as those responsible for operations, mission sustainment and business continuity and resilience map out the known issues and a plan for upgrade. They need to start immediately, as development and execution can take months or even years in large organizations. 

Stay on top of agency software with real-time visibility

Agency leaders must think ahead, plan for their software’s EOL and adopt a modern approach to rationalize tools and assets. Tool duration should be set by mission needs, risk posture and effectiveness, rather than by the contract or traditional influencing factors.

When looking to add new software to an agency’s technology, IT teams must first determine if the tool is essential. Small scale or non-disruptive “rip and replace” is most often done through a request for information and new product acquisition. When it takes a significant lift to change items like operating systems or proprietary business systems, changes are usually slow-rolled through a paid expansion of support beyond EOL while alternatives are evaluated. If EOL software is still crucial to mission operations after that analysis, teams might contact the vendor for extended support or search for an alternative to replace or greatly increase security surrounding the software. If the tool is non-essential, teams should uninstall all instances across the network.

When retiring EOL software, government IT teams need complete, accurate and real-time visibility into their environments to identify which endpoints have the software installed, where it’s actively being used and any vulnerabilities related to it as well as remediation efforts.

As time passes, the risk of serious, exploitable vulnerabilities rises as fixes are no longer provided by vendors. Often, attackers are able to gain access through a single endpoint -- one that was still running the EOL software, but went undetected by both IT security and IT operations teams because they lacked comprehensive endpoint visibility across their network. Attackers only need access to a single endpoint, and organizations are only as secure as their weakest endpoint – if they can’t see every single endpoint, they’re at risk. In fact, unknown or unmanaged systems are prone to more threats.

All this means government agencies have a serious need for real-time data. They not only require continual processes that identify unknown assets, but they must also consider enhancing their EOL processes – especially the sunset and deep search removal workflows.