End of Windows XP support will affect thousands of industrial and other systems

Microsoft no longer supports its long-standing and highly effective Windows XP operating system. Windows has stated that ‘PCs running Windows XP after April 8, 2014, should not be considered to be protected, and it is important that you migrate to a current supported operating system’.

  

This move could adversely affect millions of both personal and professional users across the globe, including the many companies that have implemented Windows XP in industrial automation applications. 

 

As the longest-supported Windows operating system, XP is most widely used in industrial automation, with its myriad electrical and electronic systems. This means that potential issues arising from the discontinued support could affect a large number of end users.

 

Cybersecurity is the largest concern related to the continued use of Windows XP in industrial automation. Without the ongoing security updates to protect systems from attacks, users will be exposed to new threats that can exploit vulnerabilities of the operating system. Such threats exist to industrial automation equipment operating on Windows XP, perhaps most notably industrial PCs (IPCs) and distributed control systems (DCS).

 

Stuxnet, a highly effective and very cunning computer worm that was discovered in June 2010 is a case in point. It was designed to attack industrial PLCs, especially one model from Siemens.

 

Stuxnet worked by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to speed up still further and wreck themselves.

 

Industrial automation’s market response

 

Since the original announcement in 2007 that XP support will end in April 2014, many end users have upgraded to more modern operating systems that Microsoft says will continue to be supported. Larger companies - especially those driven by IT departments - were typically more proactive in making advance preparations to upgrade early where necessary. 

 

In contrast, smaller companies - those that may be less driven by IT - have delayed upgrades until absolutely necessary, with many yet to convert.

 

IHS (www.ihs.com) says that a large stock of older equipment with basic flaws in its security architecture remains that could prove problematic, and that XP is just one example of an area that will require compensating controls for necessary security requirements in an organisation to be met.

 

Even so, although a large number of end users have migrated in recent years and there is a requirement for many more to follow during the next year, IHS believes that the overall impact on the industrial automation equipment market may be fairly modest.