{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/legacy-system","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/legacy-system/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/legacy-system/"},"term":{"en":"Legacy system","da":"Legacy-system"},"aka":{"en":["legacy software","end-of-life system"],"da":["forældet system","ældre system"]},"domain":["security","cs"],"cluster":"fundamentals","layer":"host","status":"current","summary":{"en":"An old system the business still depends on but that can no longer be updated, replaced or protected in the normal way.","da":"Et gammelt system, som forretningen stadig er afhængig af, men som ikke længere kan opdateres, udskiftes eller beskyttes på normal vis."},"body":{"formal":{"en":"Hardware or software that remains in use after its maker has stopped releasing patches, or that cannot run modern security features, so known weaknesses stay open and must be handled by other means.","da":"Hardware eller software, der stadig er i brug, efter at producenten er holdt op med at udgive patches, eller som ikke kan køre moderne sikkerhedsfunktioner, så kendte svagheder forbliver åbne og må håndteres på andre måder."},"plain":{"en":"Like an old car whose maker went out of business - it still drives, but when something breaks there are no new parts.","da":"Som en gammel bil, hvis fabrik er lukket - den kører stadig, men når noget går i stykker, findes der ingen nye reservedele."},"inPractice":{"en":"At a dairy, the PC that runs the bottling line still uses a Windows version that stopped getting updates years ago; the IT department moves it to its own part of the network with no internet access and watches its traffic.","da":"På et mejeri kører den pc, der styrer tappelinjen, stadig en Windows-version, som holdt op med at få opdateringer for mange år siden; IT-afdelingen flytter den til sin egen del af netværket uden internetadgang og overvåger dens trafik."},"whyItMatters":{"en":"Such systems often run the most important processes, so they cannot simply be switched off, yet every year they grow easier to attack.","da":"Den slags systemer driver ofte de vigtigste processer, så de kan ikke bare slukkes, men hvert år bliver de lettere at angribe."}},"deepDive":{"en":"A legacy system is defined less by age than by support status: the point at which a vendor's end-of-life (EOL) date passes and security patches stop being issued. After that date, any newly disclosed vulnerability with a CVE identifier remains unremediated for the product's whole remaining life, so the exposure only grows. Well-known examples include Windows 7 (extended support ended January 2020) and Windows Server 2012/2012 R2 (October 2023); Windows 10 reached end of support in October 2025, after which the Extended Security Updates programme became the only route to patches (offered free to EEA consumers for a transitional year, and paid for organisations). The problem is compounded when the system also cannot run modern platform defences - DEP, ASLR, driver signing, TLS 1.2/1.3, TPM-backed measured boot - because it was built before those existed, so even a fully patched-to-EOL build lacks the mitigations that make later exploitation harder.\n\nLegacy is especially entrenched in operational technology and embedded contexts: industrial control systems, medical devices, building management and manufacturing lines often run decade-old Windows Embedded, VxWorks or bespoke firmware certified as a unit, where patching may void safety certification or require a plant shutdown. Protocols there frequently predate authentication entirely (Modbus, DNP3, older OPC), so the host cannot simply be hardened in place. This is why frameworks treat legacy as a risk to be managed rather than eliminated, and why the first control is always an accurate inventory: CIS Critical Security Controls v8.1 Control 2 (software inventory) and Control 1 (enterprise assets) exist precisely because you cannot protect or decommission what you have not catalogued.\n\nBecause in-place remediation is unavailable, the standard treatment is compensating controls: place the system on an isolated network segment or VLAN with strict allow-list firewall rules, remove or heavily proxy internet access, disable unused services and removable media, apply application allow-listing so only known binaries run, and put an IDS/IPS or protocol-aware monitor in front to watch its limited, predictable traffic. Virtual patching at a network or WAF layer can block known exploit patterns without touching the host. These measures align with defence-in-depth and, for regulated entities, with the risk-management obligations of NIS2 Article 21 and ISO/IEC 27001:2022 Annex A, which accept residual risk only when it is documented and consciously owned.\n\nTwo common misconceptions cause trouble. First, air-gapping is often assumed to be absolute, but data-transfer needs (USB updates, engineering laptops, historian links) create bridges that malware has repeatedly crossed. Second, \"it still works, so it is fine\" ignores that reliability and security are different properties: a system can be perfectly functional and simultaneously trivially exploitable. The genuine long-term fix is planned migration or replacement with budget and a timeline; compensating controls buy time for that project, they do not substitute for it.","da":"Et legacy-system defineres mindre af alder end af supportstatus: det tidspunkt, hvor leverandørens end-of-life-dato (EOL) passeres, og sikkerhedsopdateringer ophører. Efter den dato forbliver enhver ny sårbarhed med et CVE-id ulukket i produktets resterende levetid, så eksponeringen kun vokser. Kendte eksempler er Windows 7 (udvidet support udløb i januar 2020) og Windows Server 2012/2012 R2 (oktober 2023); Windows 10 nåede end of support i oktober 2025, hvorefter Extended Security Updates-programmet blev den eneste vej til patches (gratis for forbrugere i EØS et overgangsår og betalt for organisationer). Problemet forstærkes, når systemet heller ikke kan køre moderne platformsforsvar - DEP, ASLR, driversignering, TLS 1.2/1.3, TPM-baseret measured boot - fordi det blev bygget, før de fandtes, så selv en fuldt patchet EOL-version mangler de mitigeringer, der gør senere udnyttelse sværere.\n\nLegacy er særligt indgroet i OT- og embedded-sammenhænge: industrielle styresystemer (ICS), medicinsk udstyr, bygningsstyring og produktionslinjer kører ofte ti år gammel Windows Embedded, VxWorks eller specialfirmware, der er certificeret som en samlet enhed, hvor patching kan ugyldiggøre en sikkerhedscertificering eller kræve driftsstop. Protokollerne dér er ofte ældre end autentificering overhovedet (Modbus, DNP3, ældre OPC), så hosten kan ikke bare hærdes på stedet. Derfor behandler rammeværker legacy som en risiko, der skal håndteres, snarere end fjernes, og derfor er den første kontrol altid et præcist inventar: CIS Critical Security Controls v8.1 Control 2 (softwareinventar) og Control 1 (enhedsinventar) findes netop, fordi man ikke kan beskytte eller udfase det, man ikke har katalogiseret.\n\nFordi opdatering på stedet ikke er mulig, er standardbehandlingen kompenserende kontroller: placér systemet på et isoleret netværkssegment eller VLAN med stramme allow-list-firewallregler, fjern eller proxy internetadgangen kraftigt, deaktivér ubrugte tjenester og flytbare medier, anvend application allow-listing, så kun kendte programmer kører, og sæt en IDS/IPS eller protokolbevidst overvågning foran til at holde øje med dens begrænsede, forudsigelige trafik. Virtuel patching i netværks- eller WAF-laget kan blokere kendte exploitmønstre uden at røre hosten. Disse foranstaltninger flugter med defence-in-depth og - for regulerede enheder - med risikostyringskravene i NIS2 artikel 21 og ISO/IEC 27001:2022 Annex A, som kun accepterer restrisiko, når den er dokumenteret og bevidst ejet.\n\nTo udbredte misforståelser giver problemer. For det første antages air-gapping ofte at være absolut, men behov for dataoverførsel (USB-opdateringer, servicebærbare, historian-forbindelser) skaber broer, som malware gentagne gange har krydset. For det andet overser holdningen \"det virker jo stadig\", at driftssikkerhed og sikkerhed er forskellige egenskaber: et system kan fungere perfekt og samtidig være trivielt at udnytte. Den egentlige langsigtede løsning er planlagt migrering eller udskiftning med budget og tidsplan; kompenserende kontroller køber tid til det projekt, men erstatter det ikke."},"edges":[{"type":"causes","to":"security/vulnerability","why":{"en":"Without new patches, every weakness found after support ends stays open for good.","da":"Uden nye patches forbliver enhver svaghed, der findes efter supportens ophør, åben for altid."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"cs/network-segmentation","why":{"en":"Putting an old system on its own segment limits who can reach it when it cannot be fixed.","da":"At placere et gammelt system i sit eget segment begrænser, hvem der kan nå det, når det ikke kan rettes."},"confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 4","tier":"course-material"},{"title":"CIS Critical Security Controls v8.1 (Control 2 - Inventory and Control of Software Assets)","tier":"standard"}],"draft":true}