Archive | January 2019

The Windows 10 Clock is Ticking…

We’ve known this date is coming for a while, but today marks exactly one year to the end of Windows 7 support, and therefore the deadline date for your transformation to a “Modern Client” platform such as Windows 10.

No doubt you’ve been thinking about this a lot, and many organisations are already progressing their activities to meet this deadline.  However there may be some who are taking a different approach, and asking themselves “what exactly is there to worry about” – for example:

  • Nothing will actually stop working on January 14 2020 – if we’re still on Windows 7 it will continue to work – wont it?
  • Microsoft announced last year that they were extending support for Windows 7 through to 2023 – didn’t they?
  • We’ve been told the transition to Windows 10 is the simplest and easiest yet – isn’t it?

All of the above statements are true, to a degree, but I’d like to flip the conversation around.  The market has been dominated with the impact of “Windows as a Service” (Evergreen) and the challenges and problems that a regular update cycle will present. The above questions pose more of a “Why do I need to?” rather than a “Why should I?”.  Let’s answer both.

Why do I need to move off Windows 7 by January 14th 2020?

  • Microsoft will stop providing security and update patches on this date, leaving your devices exposed to security vulnerabilities and your organisation potentially open to compliance issues.
  • The “Extended Support Updates” to 2023 are not free – and the price is high for something that’s not moving you forward at all.
  • Your organisation and users are using 10 year old technology (Windows 7 was released in 2009). Think about what has changed in the technology world in 10 years and the opportunities you are inevitably missing out on by using old tech
  • Your application providers and partners will be modernising their solutions to work on modern technology and keep pace with the market. How long will they support the “legacy?”

So that’s the negative, arguably the “FUD” angle.  Now look at this the other way around:

Why should I be running a modern platform such as Windows 10?

  • Significant security enhancements within the Operating System, and integrated in the hardware to mitigate security threats of the modern connected world.
  • Enhanced mobility with an effective touch interface – meaning your users can work flexibly on the device of their choice in an array of location and circumstances.
  • A modern look and feel – more commensurate with what people are used to at home, supporting the ethos of “Digital Workplace”.
  • Better user experiences – higher performance, more stable, more functionality, and more regularly updated

There are a range of other benefits, these are just a few examples – but it’s clear there should be a “Pull” to upgrade as well as a “Push”.

Or from another perspective….

So all of this is logical and evolutionary.  What about a more radical revolutionary approach?

In the world of consumer choice, cloud services and pervasive mobility there are other options. You don’t need to continually furrow a Windows platform strategy.  What about adopting Apple to delight your users?  We’re seeing significant growth of Mac in enterprise and it’s viable for all use cases now.  What about alternative technology types? Does it need to be a PC – what about a Tablet or Smartphone to help your users mobility to be productive and improve customer service? With some minor tweaks you can radically change your workflows and provide a step change in how you engage your customers and enable your people.

There are various options – the point is you don’t NEED to relentlessly pursue a Windows only option – there are now very viable alternatives.

 

Either way, it’s going to be a busy 2019 – and its only just begun!  So if you need any help to get started or accelerate your activities, feel free to get in touch

2019 Security Predictions – “Ensure the basics are BRILLIANT”

Happy New Year and I hope the festive break was “a break”. Some continue to work throughout the festive season (or the global economy would meltdown), but for many back to work for 2019 started in earnest this week. I have so far avoided 2019 “predictions”, “prophecies”, “educated articulation of interesting stuff” to date based on so many of them circulating the social media and email landscape. However, a fair few messages asking for a perspective on the networking and security world for 2019 have stimulated me to scribble a few words.

And here comes the shock, I will be quite boring with my summary of the market and technology impacts for 2019 (well at least the first half) because I will continue to encourage to all who will listen that the most important edict they can institutionalize in their own psyche and the organisational operational IT approach is to ensure the basics are “brilliant”. Modern business should only have a single state, secure business with an unintentionally insecure environment almost unthinkable in the digital age. As the creation, processing, analysis and management of digital data streams continue to underpin and energize both user and business outcomes an intentionally secure by design philosophy is the only way to stem the attack tide.

Security isn’t the task of security professionals alone, but every application or system user with a level of consciousness about the consequence of breach or failure must now acknowledge “intentional security” is the responsibility of all.

Ensuring the basics are brilliant, with security controls mapped to business activity, outcome and consequence, with auditing and automation leveraged to optimize operations will increase the level of certainly of a user or organisations security posture.

·        Privileged account security

·        Multi factor authentication

·        Managed encryption.

·        Vulnerability management PLUS

·        Identity management PLUS

·        Enterprise anti phishing with associated user education

·        Intelligent endpoint security (user or things)

Can you embrace how boring the list above may seem – hopefully that’s the case. The list above are subset of the “Brilliant Basics” that MUST underpin the secure defences of all. You are possibly about to click away from this screen buoyed by the view “we have got all of those” and that may be the case. But even with great guidance from Cyber Essentials, CIS, NIST, etc many organisations I meet are a snippet of “luck” away from a comprehensive breach due to absence, failure or poor execution of the controls above with the negative consequence avoidable.

If there is no auditable and actively managed operational state of the items mentioned above integrated together to ensure security is seamless, intentional, proactive why consider the wealth of advanced and esoteric new products showcased daily – get the basics right.

So my 2019 ask so early in the year is to be brutal and rigorously appraise the brilliance of your “basic” security controls. Are they operational consistent, audited, integrated, holistic, bidirectional from an information and threat exchange, automated where possible – score your current state.

Why make it easier to be breached when organisations highly engineered, often very expensive, operational complex defences fail due to the failure to control the controllables or optimise the known basic elements.

Until next time.

Colin W

Twitter: @colinwccuk

LOB CTO – Networking and Security Computacenter UK

Note: This perspective is the viewpoint of Colin Williams and does not constitute an opinion of Computacenter Group.