Managing Windows XP After Extended Support Ends

On Apr. 8, 2014, Windows XP, Office 2003, and several other Microsoft enterprise software products still deployed by many organizations leave Extended support. This means that as of this date, Microsoft will no longer fix any problems found in these products, including security vulnerabilities. The riskiest of these products to continue to run without support is Windows XP. Therefore, customers who have not yet migrated away from Windows XP need to either have custom support contracts in place or take immediate steps to mitigate the risk of running these products past the end of Extended support.

Migration Away from Windows XP Recommended

The easiest way to remediate the risk posed by Windows XP is to migrate away from the OS, but for many, that will not be an option for some time. Migration away from Windows XP should re-emphasize to organizations that software, even if perpetually licensed, is not perpetually supported. All software has an expiration date.

Customers should clearly understand that Microsoft will no longer be providing security updates for newly discovered vulnerabilities in Windows XP. This includes all versions of Internet Explorer (IE) running on XP, which Microsoft considers to be an integral part of the Windows OS, including IE6, IE7, and IE8. Windows XP and available versions of IE continued to receive security hotfixes over the last year of Extended support, indicating that there are likely vulnerabilities yet to be discovered. Therefore, organizations choosing to continue to use Windows XP in production should assume there will be future exploits of the OS and its integrated browser, which could leave systems running Windows XP at significantly higher risk for exploitation than systems running current versions of Windows and IE.