Managing Obsolete (Yet Business Critical) Systems

All links and images from this episode can be found at CISO Series (https://cisoseries.com/defense-in-depth-managing-obsolete-yet-business-critical-systems/)

Obsolete systems that are critical to your business. They're abandoned, unpatchable and unmanaged. We've all got them, and often upgrading is not an option. What do you do?

Check out this post and discussion for the basis of our conversation on this week’s episode co-hosted by me, David Spark (@dspark), the creator of CISO Series and Allan Alford (@AllanAlfordinTX). Our guest for this episode is Mitch Parker (@mitchparkerCISO), Exec. Director, InfoSec and Compliance, Indiana University Health.

Thanks to this week’s podcast sponsor, SecurityBridge

Advanced cybersecurity for SAP, from codebase to production. Powered by anomaly detection, detect threats in real-time so that they can be remediated before any harm is done. Eliminate false-positives and focus on actionable intelligence. Ensure compliance with direction to actual vulnerabilities, with amazing intelligence dashboards guiding remediation.

On this episode of Defense in Depth, you'll learn:

• This issue appears to affect every security and IT person. At one time they've all had to deal with it.
• Obsolete technology should not be treated like any new technology. It needs to be isolated.
• Lots of great advice from the community regarding containing the outdated technology through firewalls, air gapping, segmenting, virtual machines, and a jump box.
• Constantly measure the risk of not just intrusion of the outdated technology, but the cost of keeping the thing running as you can't rely on outside support or updates.
• As you're reporting the risk, constantly push for solutions to end reliance on this outdated technology.
• The obsolete technology is often an expensive and critical piece of hardware that's difficult if not impossible to replace.
• The UK National Cyber Security Center has some great guidance on what to do with obsolete platforms.