Nothing lasts forever. That’s true for cars, devices, even a favorite sweatshirt or pair of jeans. But it is especially true for information technology (IT). 

Legacy IT systems stick around in business settings for three main reasons: organizations don’t have the budget to upgrade, teams need to be able to access critical legacy applications and users refuse to upgrade. However, as much as employees may want to continue using Windows XP, sticking with legacy systems is a bad security practice. 

“[T]hese systems tend to have inherent security vulnerabilities and are often not compatible with security features surrounding access, including multifactor authentication, single-sign on and role-based access,” writes Ranjeeta Rani. “Each vulnerability that exists within a system is an open invitation that attracts cybercriminals attempting to exploit businesses.”

Sunsetting a legacy system is not an easy task, but it is a needed one if the company wants to move forward with its security protocols. However, you don’t simply unplug the old and plug in the new. Phasing out your legacy system requires a comprehensive strategy to carry out the process. Here are seven things to consider when implementing your sunsetting plan.

1. Recognize When to Phase Out a Legacy System

Technology tends to have a short life cycle overall, but there are some tell-tale signs when a legacy system needs to be replaced. They include:

• The developer no longer offers support for the software and patches aren’t available for newly discovered vulnerabilities
• Programming language doesn’t support new and needed applications
• It fails to meet compliance regulations
• It isn’t keeping up with current business models
• Deprecated systems that were once regularly used are now only used for a small percentage of the system. The system may accrue license fees for programs that aren’t used or become a silo for old data
• It weakens your overall security system

Every IT system has its place within the organization. When deciding to phase out a legacy system, decision-makers will have to determine how — or if — to replace it. Not every system needs to be replaced, as new technologies sometimes make old systems naturally obsolete. But that said, you can’t simply sunset a system without having an alternative ready to take its place, especially if it is a system vital to your day-to-day business operations. Not every system has a viable alternative.

Sunsetting legacy systems should go hand-in-hand with the goal to improve the organization’s work culture, its security posture, or, as more employees turn to remote work, to allow for more fluid business processes. 

The first step in a sunsetting strategy is to determine the reason behind the decision. Has the system lost its viability or added security risks? And how will replacing the legacy system impact your day-to-day business?

2. Plan for Data Migration

Data is a business’s most valuable asset, which is why cybercriminals keep coming up with more sophisticated ways to steal it. If your legacy system can no longer meet basic security practices to protect your corporate data, it is time to update to something new. 

But what do you do with the data on the legacy system? If you leave sensitive data on the legacy system, security protocols need to be maintained in order to keep it from being breached. Some legacy systems can continue to be updated if you have developers who understand the old code or if there are regular updates. Otherwise, the data will need to be migrated to new systems. To enable this, your sunsetting strategy needs to include a data migration plan. This plan should include:

• Conducting an audit on the data to know exactly what is there and where you may have redundancies
• Identifying and resolving any issues you may discover with the data during the audit
• Backing up the data to prepare for unseen problems and incidents so nothing is lost
• Maintaining data quality and integrity during the migration
• Protecting the data while in transit 

3. Back Up Everything 

Because data migration is such a complex procedure, it should be done separately from other legacy sunsetting steps. And even though you have created a backup system, it would be wise to keep data on the legacy system in a read-only mode as you transition. The decision to keep the read-only option in the legacy system depends on cost (licenses and maintenance requirements), compliance issues and the need for that data to be updated in the future. 

4. Legacy System Security

It’s easy to become complacent about security systems, especially if they appear to be working well. But legacy threat management systems need to be sunsetted just as other legacy systems do. Cybersecurity threats are constantly shifting, with hackers using more sophisticated tactics. Strategies and tools need to keep up with today’s threats and anticipate tomorrow’s attack vectors. The antivirus software that worked so well in the early part of the 2000s now needs to focus on endpoint solutions and use more sophisticated options such as zero trust or edge security.

5. Pick the Components to Transfer

You probably won’t have to sunset your entire legacy system. Or, at least, you don’t have to sunset it all at once. Instead, take the migration slowly, beginning with the most important element — maybe a database or a specific function needs to upgraded to a new system immediately. For employees, this creates a smoother transition with time to get used to the functionality of the new system while using some of the components of the familiar one. It also allows the IT and security teams to ensure everything is working and secure one component at a time, making it easier to find problems and vulnerabilities.

6. What if You Need to Roll Back the Transition?

You may discover that you decided to phase out your legacy system too soon.

As a GCN article states, “Migrating systems and applications is not the only way to improve them, and in some cases, it might not be necessary or even possible to do that, particularly when the platforms or the applications running on them are strategic to the organization.” 

This is why having backups and sunsetting one component at a time are vital elements in your transitioning plans. You prevent losing important files as well as learn how, and if, your data can be used on the new system. Some systems are so vital to core operations that it is better to keep operating as normal and build out the new system with entirely new code. Then you can plan future budgets accordingly, using part of the budget to maintain legacy systems as well as possible while increasing funds allotted for building a new system.

7. Security for Your Sunset Legacy Systems

Legacy systems may be replaced, but they never really disappear. There will be data there, or applications that someone will insist on using or an application that can only be run on that system. But since these systems often can’t be patched or upgraded, they pose a serious risk to your entire network infrastructure. 

“Legacy IT systems are often at the heart of cyber breach incidents, and because decommissioning is not usually an option, information security professionals need to manage the risk by working closely with key business stakeholders to identify all critical systems and the systems that support them,” Bobby Ford, Global CISO at Unilever, tells ComputerWeekly.

If those systems no longer have security support, he added, the best way to keep them secure is creating a network segment only for the legacy systems. This will allow IT teams to strictly control any data surrounding those legacy systems while keeping them segregated from other software and hardware on the network. Transitions can be smooth, ensuring that the only systems that last forever are the ones you want to have around.