Legacy
Legacy technology in an AI-enabled threat landscape
The NCSC's complaint is aimed at technology run on the cheap. Old, unsupported systems are where quicker attackers will find the most.
Last reviewed against NCSC, SecurityWeek and The Register. Sources
The criticism
Underinvestment named
Infosecurity Magazine reported that the NCSC chief executive faulted organisations for running systems past end of life, postponing upgrades and trimming costs [6]. He also pointed to missing lifecycle investment, access handed out for convenience, services bought mainly on price and too little monitoring to catch failures [6]. A board can ask about each of those.
The assessment
Where pressure is expected
Spotting it
Signs a system is at risk
Look for these while you inventory your estate:
- The supplier no longer ships security updates for the product.
- The system can be reached from the internet or through remote access.
- Nobody can say who owns it or when it was last patched.
- It runs a physical or safety process that is hard to take offline.
What to do
Replace, re-support or contain
Updates cannot help a system that no longer receives them, so the NCSC says to replace it or return it to support, particularly where exposed [3]. If that will take time, cut its exposure first: remove internet access it does not need and limit who can reach it [1].
Make the cost visible
Set the cost of replacing each legacy system beside the cost of the outage it could cause. The NCSC chief executive warned leaders could have to explain to customers and suppliers why essential services failed [1].
Keep reading
Read next
Access routes
The NCSC's incident data shows four initial access routes behind 88% of incidents at large organisations. What each is and how to reduce it.
Read the guide
Staff AI use
The NCSC's review warns that unapproved AI services can leak company data. How to set rules for staff without blocking useful tools.
Read the guide
Cyber Essentials
The NCSC calls Cyber Essentials the starting point for AI-era resilience. What the 75% discount covers and what to do beyond certification.
Read the guideHow CyPro can help
Need a hand getting ready?
Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Get ready
Need to know what this means for you?
The NCSC points operators of essential services to the Cyber Assessment Framework. CyPro can assess how well your organisation meets it and set out the resilience work that matters most.