Microsoft to Windows XP users: your operating system is a major security risk

Warns of XP security malaise

Microsoft isn't kidding when it says that people need to ditch Windows XP and has released alarming security numbers to prove its point; XP systems are markedly more likely to fall prey to malware than later versions of Windows.

According to the firm's Security Intelligence Report (SIR) for the first half of 2013, Windows XP SP3 32-bit suffered a malware infection rate of 9.1 systems per 1,000 computers, which sounds modest until you read that the equivalent number of Windows 7 32-bit was 5.0 and for Windows 8 64-bit it was 1.4.

To eliminate the possibility that this difference was caused by the behaviour of XP users, the firm correlated the number of infections to the encounter rate, in other words the number of systems in each OS version that met malware requiring intervention by Microsoft's security products.

Here, the different incarnations recorded roughly similar encounter rates, with XP at 16.3 percent, Vista at 16.5, Windows 7 at 19.1 percent, and Windows 8 RTM at 12.4 percent. Apart from underlining that Windows 7 is now probably the most targeted OS, it is clear that with Windows XP the ratio of encounters to infections is unflattering.

As the report's authors admit, that XP should be more vulnerable 12 years after its release than newer Windows versions is hardly surprising; malware creators have had longer to craft attacks, spot software flaws, and exploit the weaker security protection in the OS. But the point, Microsoft argues, is that the XP hardcore are taking a risk using the operating system in 2013, something that will only increase as an issue after the end of support in April 2014.

"Computers running Windows XP in 1H13 encountered about 31 percent more malware worldwide than computers running Windows 8, but their infection rate was more than 5 times as high," is the dry but accurate summary from the report authors.

Of course, all of this fits with Microsoft's earnest wish to see the back of XP and shift seats on to Windows 8. The other perspective is that Microsoft has drawn these numbers from its vast global database of systems running Windows operating systems and for this reason the numbers deserve to be taken seriously. Anyone who wants to be frightened some more might want to read a summary of the above points by Microsoft's director of trustworthy computing, Tim Rains.

For firms not able to abandon XP in 2014 for technical reasons (i.e. the need to support inhouse applications), the options are to use XP in a desktop virtualisation environment, adopt a policy of OS isolation (locking down applications, disconnecting USB ports, limiting Internet connectivity) or even buy a probably very expensive third-party support agreement.

One other interesting snippet from the report is the apparently shockfinding that running real-time antivirus software seems to be a good idea, or at least greatly reduces infection rates; malware infection rate is 7.1 times higher for those systems running real-time antivirus compared to those that don't.

This doesn't mean that when antivirus fails, it doesn't fail spectacularly - and often enough to cause major concern about its effectiveness against targeted attacks - but does underline that rumours of its imminent death are exaggerated.

Join the CSO newsletter!

Error: Please check your email address.

Tags Microsoftsecuritysoftwareinteloperating systems

More about MicrosoftSIR

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by John E Dunn

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts