Over the past few months, a shift to remote working has raised many security questions for businesses trying to protect their data. And, ensuring that legacy systems are secure is a key priority. 

Keeping legacy systems up to date in a world of increasing cyber threats has been a concern the past few years, but it has become more prevalent as the pandemic has changed the ways in which companies to do business.

Legacy systems contain outdated hardware and software that is not always easy to replace. As a result, these systems can be unable to accommodate today’s security best practices. Additionally, these systems tend to have inherent security vulnerabilities and are often not compatible with security features surrounding access, including multifactor authentication, single-sign on and role-based access. Legacy systems can also lack sufficient encryption methods.

Each vulnerability that exists within a system is an open invitation that attracts cybercriminals attempting to exploit businesses. However, many businesses continue to use these end-of-life operating systems to access critical legacy applications on these servers that are essential to manage their business. But, how can companies keep their operations running with a legacy system while also focusing on cybersecurity?

There is no simple answer, but one of the first steps to protect against these attacks is to stay up to date on operating system patches and system software. 

Here are actions to take to improve your security framework for a legacy system.

All Legacy Servers

  1. Conduct a vulnerability assessment to identify what needs fixing and where your weaknesses lie.
  2. Assess where your legacy system is located and how much of your environment is legacy.
  3. Determine what categories of data you have stored on these servers.
  4. Update your inventory.
  5. Keep track of old servers that may no longer be required, but are sitting in your environment. Decommission those servers first.
  6. Compile a list of the owners of each server and application.

Non Internet-Facing Legacy Servers 

  1. Apply the most recent patches for your operating system wherever possible.
  2. Begin to harden your operating system.
    • Remove any unused applications and services.
    • Create rules and policies to help govern your system in a secure manner.
    • Configure and update your operating system securely.
  3.  Identify ways to further harden the operating system. 
  4.  Assess who needs access to these systems and the level of access required. Revalidate their access.
  5. Ensure you have an antivirus solution. Most antivirus vendors have likely stopped supporting some of these operating systems. But, these vendors still release definitions and provide extended support wherever possible for antivirus and operating systems.
  6. Add an extra layer of security on the host. If possible, have file integrity solutions in place to support the legacy system or host-based intrusion prevention software installed on your legacy servers.
  7. Have timely backups and snapshots taken for these systems to be used for disaster recovery cases.


Internet-Facing Legacy Servers 

  1. Decommission or upgrade your server. If you cannot do this immediately, move on to the next steps. 
  2. Fo a web server, add an application firewall to protect against 5 (session) and 7 (application) layer attacks. There are also cloud-based security solutions available. Speak to your cybersecurity architects to find the best solution that fits your needs.
  3. Assess what data resides, or is accessed by your server. Critical or sensitive data should not be on these servers.
  4. Perform periodic vulnerability scans to find ways to address vulnerabilities and close gaps wherever possible.
  5. Limit the traffic from these legacy to your organization’s network.

Additionally, all businesses using legacy systems should invest in different layers of security within the company, including endpoint solutions, network-based IPS, proxy solution and a solution for email security. Lastly, educate your team on how the importance of security and build a culture that reflects a security-first mindset.

More from Application Security

X-Force Identifies Vulnerability in IoT Platform

4 min read - The last decade has seen an explosion of IoT devices across a multitude of industries. With that rise has come the need for centralized systems to perform data collection and device management, commonly called IoT Platforms. One such platform, ThingsBoard, was the recent subject of research by IBM Security X-Force. While there has been a lot of discussion around the security of IoT devices themselves, there is far less conversation around the security of the platforms these devices connect with.…

4 min read

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

12 min read - ‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

12 min read

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

4 min read - Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

4 min read

Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers

17 min read - Overview In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities. Over the last few years, public accounts have increasingly shown that less sophisticated attackers are using this technique to achieve their objectives. It is therefore important that we put a spotlight on this capability and learn more about its potential impact. Specifically, in this post, we will evaluate how Kernel post-exploitation can be used…

17 min read