Many Companies Caught in Lurch as Microsoft Ends Support for Windows XP 2
Support ends on July 13

On July 13, Microsoft will officially retire Windows XP Service Pack 2. Although it will continue to provide security updates for XP Service Pack 3, it will stop providing patches for the older SP2. Microsoft offers support for its products for five years and extended support for another five years. For XP SP2, that journey comes to an end on July 13. Windows XP 3 will be supported until April 2014.

Microsoft issues security updates and other core operating system patches every second Tuesday of the month, known as Patch Tuesday. Whereas most home users typically install these patches automatically, corporate users usually install service packs and security updates manually and only after extensive testing. For large corporate environments, operating system upgrades are often a very perilous and expensive exercise.

According to security risk and compliance management provider Qualys, 50 percent of the several hundred thousand PCs it monitors for its clients are still running Windows XP SP2. Most of these are probably user desktops, but some may also be applications and appliances that use Windows XP 2 as the base platform. Upgrading such systems may make them inoperable.

According to Sajed Naseem, principal at Washington DC based security firm, Secure Intervention,

" The longer these systems linger after the July 13 deadline, the more vulnerable they become. There will undoubtedly be many Windows XP 2 systems still out there and hackers know that. Only there will no longer be security patches coming from Microsoft as new holes are discovered and publicized."

About William McBorrough
William McBorrough is President and Information Security Subject Matter Expert at Washington, DC based Information Security and Technology Services Firm Secure Intervention, where he specializes in Security Assessments, Compliance Readiness, IT and Security Management and Cloud Computing Security for both public and private sector enterprises. He is also an Adjunct College Professor teaching Systems Architecture, Networking, Network Attacks and Defense, and Security Program Development courses. He holds CISSP, CISA, and CEH certifications and is pursuing a Phd in Information Security with a concentration in Information Security and Assurance.