For machines that cannot be upgraded, what needs to change now that Microsoft Windows XP support has ended?
Ask Control Engineering: For manufacturers that may not be able to upgrade certain machines or systems past Microsoft Windows XP, what should change now that Microsoft Windows XP support has ended? Answers for related questions below are provided by Debra Lee, software specialist, Beckhoff Automation.
Q. What happens to machines using Microsoft Windows XP when Microsoft support ends April 8?
A. Now that support from Microsoft for Windows XP has ended, machines with this operating system (OS) will no longer be able to get OS updates, including security updates. Naturally, best practices dictate that machines be kept up to date with the latest security updates. However, most of these machines are not connected to the Internet, and those that are generally are not used for surfing the Internet nor do they open files or attachments in software applications such as e-mail, both of which are notorious for the spread of viruses and malware. It is important to note as well that many machines are actually running Windows XP Embedded. Support for Windows XP Embedded is still active and does not end until Jan. 12, 2016.
All that said, it is important to fully understand the current situation to learn if and when a corrective action may need to be taken to address the OS on a machine.
Q. What have Beckhoff software engineers been recommending to customers?
A. It is recommended to assess each machine’s individual security risks and take action as appropriate. Every application is different and so too are the potential risks. Simply securing access to a machine can go a long way towards reducing many potential security threats. This extends not only to Internet connectivity, but also to USB devices. Only USB devices that are "verified clean" from authorized personnel should be permitted on the industrial devices that are equipped on machinery. USB flash drives that are used for any personal reason (photos, music, etc.) should never be used on a machine, regardless of the OS used.
Beckhoff is a Microsoft Windows Embedded Gold Partner, and our software experts work closely with Microsoft in the development, implementation, and support of Windows OS products in industrial applications. Gold status is the highest and most exclusive level of the Microsoft partner program. We leverage this relationship in order to better support our customers and provide recommendations for best practices. For our customers, Beckhoff provides detailed "how-to" documentation for securing Beckhoff Industrial PCs (IPCs) and Embedded PCs on our website. This documentation is continuously updated and it provides information to help protect against potential security threats. Link to a Beckhoff Automation security document here.
Q. If customers cannot upgrade, what should change, if anything, on April 9?
A. If a security audit finds that access to the machine is secured and there is no Internet connectivity or e-mail "read" access with file download capability on the machine, nothing necessarily needs to change today even if a machine has devices with Windows XP OS on it. If the security audit finds a potential hazard in these areas, however, action may need to be taken to remove the access points, or if that is not possible for some reason, upgrade the device(s) on the machine. Of course, users should remember that Windows XP Embedded support is still active and will continue to be active until the beginning of 2016.
Q. Will you (or others?) be providing Windows XP patches if vulnerabilities are exposed after April 8?
A. We do not provide security patches for the Windows XP operating system. Microsoft recommends that to stay protected, one should upgrade or replace PCs running Windows XP; however, their perspective is more focused on business and consumer PC users.
Microsoft has a help page on the end of Windows XP support.
Bottom line: This is not the first OS obsolescence event for industrial device users and it won’t be the last. In fact, there are still industrial PCs in the field today running DOS with reliable performance and no problems. Users just need to be cognizant of how their machinery is connected to the outside world, if at all, and how secure the access to these machines is.
– Edited by Mark T. Hoske, content manager, CFE Media, Control Engineering, firstname.lastname@example.org.
-See links to related Microsoft Windows XP advice and information below.