Some federal agencies face a race to upgrade their computers with less than six months to go until Microsoft stops providing free patches to an older, still prevalent operating system.<\/p>\n\n\n\n
As of the end of July, 31 percent of federal civilian agency computers still run on Windows 7, according to an official from the Cybersecurity and Infrastructure Security Agency (CISA), an entity inside the Department of Homeland Security that protects critical infrastructure from cyberthreats.<\/p>\n\n\n\n
Microsoft\u2019s free support for Windows 7 ends Jan. 14, 2020. After that date, enterprise customers that have not completed an upgrade to Windows 10 will have to pay for extended security updates to receive security updates, a Microsoft spokesperson said. Those updates are available for three years.<\/p>\n\n\n\n
A CISA official said that the agency is \u201ccurrently monitoring\u201d the use of Windows 7 within civilian agencies.<\/p>\n\n\n\n
\u201cI don\u2019t think it\u2019s acceptable,\u201d said retired Brig. Gen. Greg Touhill, the U.S. government\u2019s first federal chief information security officer and current president of Cyxtera Federal Group, an enterprise IT and infrastructure security company, of the government\u2019s current Windows 7 exposure.<\/p>\n\n\n\n
\u201cThis is adding extensive risk because older operating systems that are not supported by the manufacturers … are increasingly adding significant risk exposure in the cyber domain.”<\/p>\n\n\n\n
The CISA official said that civilian agencies have reduced exposure to the operating system by 26 percent from the fourth quarter of 2018.<\/p>\n\n\n\n
\u201cWe continue to work to raise awareness of the associated risks of legacy software, provide risk mitigation recommendations for the instances where the continued use of legacy software is required, and provide support through direct agency engagement,\u201d a CISA official said in a statement.<\/p>\n\n\n\n
Within the Department of Homeland Security, home to CISA, Windows 7 exposure sits around 3 percent, a CISA official said.<\/p>\n\n\n\n
The Department of Defense declined to say what the DoD\u2019s current mix of operating systems is, but Elissa Smith, spokesperson for the Pentagon, said that in February 2016 the department \u201cinitiated the rapid transition to Microsoft Windows 10 Secure Host Baseline (SHB) in order to strengthen our cybersecurity posture while concurrently streamlining the IT operating environment.\u201d<\/p>\n\n\n\n
As of June 2019, she said, the upgrades are \u201csubstantially complete.\u201d<\/p>\n\n\n\n
Inquiries to all 24 CFO Act agencies found that there is still work to be done across several civilian agencies, including Cabinet departments. For instance, the Department of Veterans Affairs told Federal Times that more than 40 percent of its 500,000 computers have upgraded to Windows 10. It is \u201con track\u201d to finish the upgrade before the January date, a spokesperson said.<\/p>\n\n\n\n
The Small Business Administration is \u201cactively rolling out\u201d Windows 10, an agency spokesperson said. The agency is \u201cabout 50\/50\u201d on migration of its 4,350 computers, according to the spokesperson, and plans to finish the migration at the end of October.<\/p>\n\n\n\n
The Department of Education led among cabinet agencies, with a total of zero computers running on Windows 7, according to a spokesperson. A Department of Labor spokesperson said that, as of January 2019, it upgraded 16,810 computers to Windows 10, with just 400 left to upgrade. Those computers are \u201cbeing actively replaced\u201d and will be upgraded before January 2020.<\/p>\n\n\n\n
The State Department and Interior both declined to provide information regarding Windows 7 use, citing security concerns.<\/p>\n\n\n\n
The Department of Transportation said that it was \u201caware\u201d of the Jan. 14 date and is \u201cactively working\u201d to update machines, but did not go into specifics.<\/p>\n\n\n\n
A USAID spokesperson said that it plans to fully migrate to Windows 10 by the end of December \u201cwith a significant amount of coordination and work.\u201d<\/p>\n\n\n\n
The Departments of Energy, Agriculture, Commerce, Housing and Urban Development, Justice, Treasury and Health and Human Services, as well as the Environmental Protection Agency, did not respond to multiple requests for comment. NASA and the Social Security Administration also did not respond.<\/p>\n\n\n\n
A General Services Administration spokesperson said that less than 7 percent of its system run on Windows 7 and plans to finish the migration by the end of the year. The National Science Foundation has no physical machines running Windows 7, a spokesperson said.<\/p>\n\n\n\n
The Nuclear Regulatory Commission, which regulates commercial nuclear power plants and nuclear materials, has migrated almost 87 percent of its computers to Windows 10. It plans to finish the upgrade by the end of November and is ahead of schedule, an NRC spokesperson said.<\/p>\n\n\n\n
The Office of Personnel Management, which experienced a massive data breach in 2015, said it will be prepared for Microsoft to stop servicing Windows 7, spokesperson said.<\/p>\n\n\n\n
\u201cThe vast majority of OPM\u2019s IT assets run on the latest operating systems. We do have some specialized applications running on Windows 7, but we have a program in place to update these systems in advance of Jan. 14,\u201d an OPM spokesperson said.<\/p>\n\n\n\n
Itzik Kotler, co-founder and chief technology officer of SafeBreach, a breach and attack simulation company, said that the numbers weren\u2019t too alarming.<\/p>\n\n\n\n
\u201cAccepting the fact that the government has many assets to manage, has many projects to do, it\u2019s understandable that it\u2019s never going to be a zero,\u201d Kotler said.<\/p>\n\n\n\n
\u201cObviously we would all like that number to be zero; that\u2019s the best-case scenario. But what we\u2019re missing here is \u2026 where are those assets and what are they connected to.\u201d<\/p>\n\n\n\n
Microsoft declined to tell Federal Times how much the security updates cost for agencies. However, in a statement the company said that it is \u201ccommitted to helping our customers remain secure.\u201d<\/p>\n\n\n\n
\u201cWhile we provide long lead times for upgrades, we understand that some customers still need more time, which is why we have several options for our customers \u2014 services like Microsoft FastTrack to expedite migrations, desktop virtualization using Windows virtual desktop or paying for extended security updates annually for up to three years,\u201d a Microsoft spokesperson said.<\/p>\n\n\n\n
Touhill said that, given the vast amount of sensitive data the government collects, the federal government needs to look beyond temporary fixes and ensure that it has upgraded to the latest operating systems.<\/p>\n\n\n\n
\u201cIt\u2019s critically important that we minimize the risk exposure to commensurate with our risk appetite,\u201d Touhill said.<\/p>\n","protected":false},"excerpt":{"rendered":"
Some federal agencies with older operating systems still have a way to go to mitigate potential risk exposure.<\/p>\n","protected":false},"author":7,"featured_media":37646,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":29,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,29,32],"tags":[],"coauthors":[3252],"class_list":["post-12204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters"],"acf":{"subheadline":"","legacy_arc_id":"6E3VALS4E5EJDFEIXRDUSUPOSE","arc_canonical_url":"\/it-networks\/2019\/08\/14\/are-federal-agencies-prepared-for-the-end-of-free-windows-7-support\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n