{"id":21248,"date":"2024-08-28T11:04:45","date_gmt":"2024-08-28T18:04:45","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=21248"},"modified":"2024-10-22T09:50:48","modified_gmt":"2024-10-22T16:50:48","slug":"unveiling-the-risks-of-legacy-systems-and-how-to-mitigate-them","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/unveiling-the-risks-of-legacy-systems-and-how-to-mitigate-them\/","title":{"rendered":"Unveiling the Risks of Legacy Systems and How to Mitigate Them"},"content":{"rendered":"\t\t
A few years ago, a report from the U.S. Government Accountability Office (GAO) revealed that <\/span>10 legacy systems<\/span><\/a> belonging to federal authorities were between 8 to 51 years old and cost approximately $337 million annually to maintain. These systems were present in the Departments of Defense, Education, Treasury, Homeland Security, Transportation, and Social Security Administration and included a 14-year-old COBOL system in use by the Air Force and an 18-year-old industrial control system utilized in U.S. dams and power plants.<\/span><\/p> While most of our federal agencies have made concerted efforts to modernize their technology and move to cloud environments, others have either partial or no technology improvement plans in place. One good example of the successful modernization of legacy systems is the U.S. Air Force, which underwent updates despite the considerable budgetary strain of the contract. <\/span>GAO reports recorded savings reached approximately $34 million annually. <\/span><\/a>Unfortunately, although all federal agencies have been made aware of the risks associated with using legacy systems, many simply lack the funds, skilled personnel, time, and expertise to navigate such large-scale changes.\u00a0<\/span><\/p> To address this need, the U.S. Government has introduced special initiatives for critical infrastructure entities, such as the<\/span> Bipartisan Infrastructure Law (BIL).<\/span><\/a> This legislation addresses pressing technology modernization needs by allocating funding to deserving organizations, aiding them in fortifying their defenses against escalating cyber threats. Early indicators suggest that BIL funding has surpassed <\/span>$448 billion<\/span><\/a>, <\/span>supporting 51,000 projects encompassing road paving, water systems, bridges, and other extensive transit initiatives.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t To put it simply, cyber attackers enjoy targeting\u00a0 legacy systems, as they are easy to exploit\u2014akin to taking candy from a baby! D<\/span>ue to their age and lack of support, legacy systems often harbor critical vulnerabilities that can be exploited by malicious actors. Similarly, end-of-life software, lacking security updates, becomes an attractive target for hackers seeking to exploit known vulnerabilities. For instance, <\/span>Microsoft no longer supports Windows 7 or earlier versions and Apple dropped support for macOS versions prior to macOS 11 (Big Sur), thus putting any company or individual using these versions at risk of attack.<\/span><\/p> Additionally, as legacy systems are extensively used across critical infrastructure sectors, such as dams, water treatment systems, power plants, hospitals, and schools, any attack on them can have significant immediate and far-reaching consequences. Furthermore, despite modernization efforts, many legacy systems are vulnerable to inter-system attacks as they lack robust defenses compared to the cloud-based platforms they are linked to, leaving U.S. infrastructure organizations highly susceptible to exploitation.<\/span><\/p> In the words of Christopher Wray, Director of the Federal Bureau of Investigation, who reported that Chinese government-linked hackers had breached a large portion of US critical infrastructure, including 23 pipeline operators, \u201c<\/span>The fact is, the People\u2019s Republic of China\u2019s targeting of our critical infrastructure is both broad and unrelenting.<\/b>\u201d He also warned that hackers would aim to \u201c<\/span>to land low blows against civilian infrastructure to try to induce panic.\u201d<\/b> – Vanderbilt Summit on Modern Conflict and Emerging Threats, Nashville, April 18, 2024<\/span><\/a><\/p> A few months ago, the FBI issued a statement warning\u00a0 critical infrastructure entities against potential attacks. Notably, US critical infrastructure has been under a steady series of cyberattacks led by international state-backed hackers from Russia and China.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\tWhere are Legacy Systems Still In Use?\n<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
<\/ul>\n
\n \t
\n \t
\n \t
\n \t
\n \t
\n \t
\n \t
\n \t
Why do We Need to Pay Attention to Legacy Systems Used by Critical Infrastructure?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
Recent Attacks on Critical Infrastructure Facilitated Through Legacy Systems or Unpatched Software<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t