The clock is ticking on Windows Server 2012 and 2012 R2. Once end of support is reached, the absence of security patches means your data and applications will be vulnerable to attack if they haven’t been migrated.

With so many moving parts, it’s not unheard of for a migration to take around 18 months, so teams will need to start migration projects now. But what are the real implications of doing nothing?

• Security vulnerabilities. Beyond 10th October 2023, Microsoft won’t issue any updates, patches, or fixes creating potential vulnerabilities for hackers to exploit. Ransomware is constantly evolving. Any delay to patching a system can open the door to attack and the longer you leave it the more chance there is of that happening . Many companies don’t realize it’s happened until weeks later and costs can run into the $millions.
• Risk of fines. Research has shown the most targeted industry sectors include financial and healthcare, both of which are highly regulated. If you aren’t using secure, patched systems, then you’re likely not in compliance with industry regulations, which can result in severe fines.
• Personal liability for leadership.  While directors and officers are largely protected, there are some signs that the tide is turning, notably in the increasing number of legal cases being brought against them. A court decision in ‘Caremark’ established a legal framework for holding directors personally liable for failing to ‘appropriately monitor and supervise the enterprise’.
• Applications will not function correctly: If you are operating under policies, such as the Modern Lifecycle Policy, you’re required to use the most current and updated applications. But when those applications are updated, they aren’t done so with an outdated server OS in mind resulting in performance, compatibility, and reliability issues over time.
• Operational Risk: Without support from Microsoft after the EOL date, anything that “breaks” could severely impact operations.

How to minimize security threats

The answer to avoiding security breaches and the costs (both financial and reputational) associated with them, is to migrate to a new server OS. But as with any IT transformation program, if managed poorly, there are many opportunities for error that can also create security risks.

UK bank, TSB, found this out when lack of stringent testing and the too early execution of a server migration caused the company to suffer major customer outages and opened the door to fraudulent activity, costing it £330 million in compensation.

Here are some steps you could put in place to mitigate security risks of your server migration:

Human oversight or error was cited as the fault of a botched server migration of a company that archived emails for medical device vendor, Zoll. During the migration in 2018 a network configuration error compromised the personal and medical data of 277,139 patients leading to Zoll filing a lawsuit against the IT service vendor.