Why not just stay on XP after April?

Spencer Starkey says an XP security gap must be tackled - particularly in SMBs

Windows XP will officially reach end of life on 8 April, yet some say that almost a third of PCs are still running it. This leaves smaller businesses at risk particularly from the lack of technical support and security updates.

Windows 7 or 8 migration is costly and time consuming, so small businesses with limited budgets and IT expertise may find it challenging. Yet many of these businesses have yet to grasp the risk of not upgrading their OSes. Worryingly, many SMBs might also assume Microsoft's extension of its anti-malware support for Windows XP will provide some protection.

Smaller businesses are thus likely to need guidance. For them, the technology landscape has become increasingly confusing – creating an opportunity for the channel to become a vital ally. We know many retailers, for example, are struggling with OS migration because there are application compatibility issues with many point-of-sale systems only supported by Windows XP.

Many retailers also do not fully understand that compliance with rules such as PCI DSS will decline should they continue with an unsupported and unprotected system.

Providing step-by-step guidance on migration plans or advice on short-term security measures that will maintain data security can help here, and it will ensure partners are best placed to offer a longer-term road map for their IT requirements.

Let roles and responsibilities define privileges. Admin rights are often given to all staff by default, and here the channel could tell SMBs in particular that they should allow this privilege only to staff who really need it. Security risk can be substantially mitigated in this way.

Ensure customers have storage and buffer overflow protection enabled. This will help protect them against malicious exploits. Unsupported operating systems such as XP make the user more vulnerable to zero-day threats as well, which means businesses should deploy intrusion prevention systems.

Deploy dynamic white lists at SMB customers. This should apply a level of control, reducing the chance that unauthorised software could install and execute on legacy systems. This will reduce the need to continually chase up software updates and patches.

An application not on the white list will be prevented from executing and will be reported, reducing the threat via the end point.

Make real-time visibility a priority for SMB customers. One of the biggest threats to businesses of all sizes is the time elapsed between an attack, its discovery, and its remediation. Real-time visibility can give companies a head start.

Small businesses are already prime targets for cybercriminals, yet they are often unaware of this. If they are aware, they may be unsure how to deal with the sheer scale of increasingly sophisticated attacks.

I have read that 500 million machines could still be running XP. VARs and MSPs should also see this as an opportunity to expand their own product portfolio. For example, partners specialising in desktop infrastructure can now look to provide SMB security support as well.

It is an opportunity to explore new revenue streams and expand offerings while developing one's positioning as a trusted adviser integral to customer success.

Spencer Starkey is UK and Ireland channel director at McAfee