As the end of support for Windows Server 2012 and 2012 R2 (hereafter referred to as WS2012) approaches on October 10, 2023, it is important for infrastructure and operations (I&O) leaders to develop and execute a migration strategy to mitigate the increased security risks posed by servers running this operating system (OS). In particular, the risk of ransomware infections and other security breaches will increase after support ends.
According to Gartner, a significant portion of the Windows Server installed base still has production systems using WS2012. However, business and application leaders may resist the need to migrate, as upgrading the OS may also require upgrading multiple applications and there is often no process in place to decommission applications or archive data. Additionally, unexpected costs can arise if a full inventory of affected server instances and applications is not completed prior to the migration project, and if post-migration maintenance and support work is not budgeted for.
To address these challenges and minimize the risks of running unsupported systems, I&O leaders and security and risk management (SRM) leaders should take the following steps:
-
Catalogue all servers, applications, and databases with dependencies on WS2012.
-
Determine migration priorities by evaluating the business impact, ease of migration, and risk for each application or system, and demonstrate some quick wins by immediately migrating IT-controlled assets.
-
Create a migration strategy for each application and system by determining whether to upgrade, migrate to the cloud, remediate, or isolate. Begin executing migrations as soon as possible.
-
Expand the relevance of the business case beyond risk reduction and remediation costs. Include benefits and incentives for key stakeholders, in addition to the risk reduction and remediation costs.
It is important to note that Gartner expects that by 2026, 75% of organizations that do not complete their migration from WS2012 or WS2012 R2 will suffer a security breach and/or data loss. Therefore, it is crucial for I&O leaders to take action now to migrate their systems to a supported OS.
In addition to the security risks, there are also potential benefits to upgrading or migrating systems to a newer OS. These can include increased performance, new features and capabilities, and the ability to take advantage of new technologies. By including these benefits in the business case for migration, I&O leaders can make a stronger argument for the importance of upgrading or migrating systems and applications.
In conclusion, the end of support for WS2012 is fast approaching, and it is essential for I&O and SRM leaders to take action now to mitigate the increased security risks posed by systems running this OS. By cataloguing servers, applications, and databases with dependencies on WS2012, determining migration priorities, and creating a migration strategy, I&O leaders can ensure a smooth and successful transition to a supported OS.