On April 8, 2014, Microsoft will withdraw support for its XP operating system. While this isn’t new news (Microsoft made the announcement in 2007), it’s quickly becoming an issue for the world’s automated teller machines (ATMs). Of the 2.2 million ATMs in the world, 95% run Windows XP. Of these, only about a third will be upgraded by the April 8th deadline.
These banks then face a choice: upgrade to a newer operating system (which will have to be done eventually anyway), pay for extended support, or go it alone. We can look at the potential consequences for each decision – and the reasons behind the choices – in a Cause Map, a visual form of root cause analysis.
First we look at the consequences, or the impacts to the goals. The customer service goal is impacted by the potential exposure to security threats. (According to Microsoft, it’s more than just potential. Says Timothy Rains, Microsoft’s Director of trustworthy computing, “The probability of attackers using security updates for Windows 7, Windows 8, Windows Vista to attack Windows XP is about 100 per cent.”) Required upgrades, estimated to cost each bank in the United Kingdom $100M (US) by security experts, impact the production/schedule and property/equipment goals. Lastly, if implemented, extended service/ support contracts will impact the labor/time goal. Though many banks have announced they will extend their contract, the costs of such an extension are unclear, and likely vary due to particular circumstances.
As mentioned above, banks have a choice. They can upgrade immediately, as will be required at some point anyways. However, it’s estimated that most (about two-thirds) of banks worldwide won’t make the deadline. They will then continue to operate in XP, with or without an extended service/ support contract.
Operating without an extended contract will create a high vulnerability to security risks – hackers and viruses. It has been surmised that hackers will take security upgrades developed for other operating systems and reverse engineer them to find weaknesses in XP. The downside of the extended contracts is the cost.
Given the risk of security issues with maintaining XP as an operating system, why haven’t more banks upgraded in the 7 years since Microsoft announced it would be withdrawing support? There are multiple reasons. First, because of the huge number of banks that still need to upgrade, experts available to assist with the upgrade are limited. Many banks use proprietary software based on the operating system, so it’s not just the operating system that would need to be upgraded – so would many additional programs.
The many changes that banks have been dealing with as a result of the financial crisis may have also contributed to the delay. (For more on the financial crisis, see our example page.) Banks are having trouble implementing the many changes within the time periods specified. Another potential cause is that banks may be trying to perform many upgrades together. For example, some ATMs will move to a new operating system and begin accepting chip cards as part of the same upgrade. (For more about the move towards chip cards, see our previous blog.)
Some banks are just concerned about such a substantial change. “I ask these companies why they are using old software, they say ‘Come on, it works and we don’t want to touch that,'” says Jaime Blasco, a malware researcher for AlienVault. The problem is, soon it won’t be working.
To view the Outline and Cause Map, please click “Download PDF” above. Or click here to read more.