Story image

England’s second largest police force still reliant on vulnerable Windows XP

21 Sep 2017

The second largest police force in England laid its bones bare to the BBC, revealing more than one in five of its computers were still running Windows XP as of July.

This accounts for 1,518 computers within the Greater Manchester Police that are running the ‘ancient’ operating system, or 20.3 percent.

This is extremely concerning, as Inflobox technology director, Dr Malcolm Murphy attests given Windows XP has been largely unsupported since 2014, so devices cannot be patched against newly found vulnerabilities, leaving any organisation still running on this operating system open to exploitation.

“The extent to which vulnerable operating systems can be exploited and impact essential services was exemplified during the recent WannaCry attack, during which a vulnerable element of the Windows operating system - for which a patch was available - was exploited in those organisations left unpatched,” says Dr Murphy.

“Of course it can be difficult to update systems that are still relied upon for vital processes. In the meantime, any organisation using outdated operating systems need to be on high alert for potential cyber-attacks.”

The figure from Greater Manchester Police was disclosed as part of a wider Freedom of Information request – something that the country’s biggest police force (London), among many others refused to disclose due to citing security concerns.

Despite this, eight forces that had less than ten PCs operating with Windows XP consented to share their numbers, which included:

  • Cleveland Police said it had seven computers running XP, representing 0.36% of the total
  • the Police Service of Northern Ireland said it had five PCs still running XP, representing 0.05% of the total
  • the Civil Nuclear Constabulary said it had fewer than 10 computers in operation running Windows XP, representing less than 1% of the total, but it added none of them was on its live network
  • Gwent Police, North Wales Police, Lancashire Constabulary, Wiltshire Police and City of London Police all said they had no computers running XP

“Organisations who know that their end-points and devices have out-of-date security and are highly vulnerable should be looking at ways they can deliver security from the core of the network,” says Dr Malcom.

“DNS is widely exploited by malware and other bad actors, so inspecting DNS traffic for indicators of compromise and making DNS infrastructure a point of security enforcement is a sensible first step.”

The Greater Manchester Police force has stated they're continually reducing their reliance on the old OS.

Veeam releases v3 of its MS Office backup solution
One of Veeam’s most popular solutions, Backup for Office 365, has been upgraded again with greater speed, security and analytics.
Too many 'critical' vulnerabilities to patch? Tenable opts for a different approach
Tenable is hedging all of its security bets on the power of predictive, as the company announced general available of its Predictive Prioritisation solution within Tenable.io.
Industrial control component vulnerabilities up 30%
Positive Technologies says exploitation of these vulnerabilities could disturb operations by disrupting command transfer between components.
McAfee announces Google Cloud Platform support
McAfee MVISION Cloud now integrates with GCP Cloud SCC to help security professionals gain visibility and control over their cloud resources.
Scammers targeting more countries in sextortion scam - ESET
The attacker in the email claims they have hacked the intended victim's device, and have recorded the person while watching pornographic content.
Cryptojacking and failure to patch still major threats - Ixia
Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018.
Princeton study wants to know if you have a smart home - or a spy home
The IoT research team at Princeton University wants to know how your IoT devices send and receive data not only to each other, but also to any other third parties that may be involved.
Organisations not testing incident response plans – IBM Security
Failure to test can leave organisations less prepared to effectively manage the complex processes and coordination that must take place in the wake of an attack.