Microsoft Corp. is counting down to the end of service support for a popular Windows Server 2003. It’s more than 12 years old, and yet there are still some 380,000 servers running it in Canada.Akos Stiller/Bloomberg
You really need to upgrade your servers, Canada.
That's Microsoft Corp.'s increasingly urgent message as it counts down to the end of service support for a popular enterprise operating system called Windows Server 2003. As you can tell from the name, it's more than 12 years old, and yet there are still some 380,000 servers running it in Canada (40 per cent of Microsoft's client base).
But as of July 14, Server 2003 will no longer get security updates or patches, and any retail systems running on it will no longer be PCI compliant (a necessary credential for processing payment-card retail transactions). The Government of Canada has even issued a public safety warning, and at this point there are fewer than 100 days for companies to upgrade.
Microsoft has been messaging customers since 2013 that the end was near, but it ran into the same issue as when it announced the end of support for the desktop-based Windows XP: enterprises delayed and dithered.
"A lot of them are waiting until the last minute," says John Czernuszka, the Chief Strategy Officer for Infrastructure Guardian, a Toronto-based IT consultancy that works with large and small enterprises on cloud and data centres.
There are about 80,000 of the Windows 2003 servers in large business settings, according to Mr. Czernuszka, which might represent 30 per cent to 50 per cent of a business's total server fleet. Many of these entities will have Microsoft Premier support, through which they have the option of purchasing a custom support package to carry them beyond the deadline. It could cost upward of $1-million in the first year, and it goes up every year after that.
Such a solution is likely not available or too expensive for small and medium businesses. Moreover, "they are probably not aware of [the deadline]," Mr. Czernuszka says.
Worryingly, the 220,000 or so servers running inside small and medium businesses are likely more exposed to potential hackers or other security intrusions.
"They put everything on there. They put database applications, e-mail servers – a lot of times they use it as a workstation," he says.
Anything from a malicious e-mail to a user browsing an infected website could open the system to attack. Such customer data as addresses, phone numbers and credit-card numbers are much-sought-after information in the digital criminal underworld. Some security experts believe hackers wait for moments such as this, hoarding potential flaws to exploit until Microsoft is no longer going to fix any problems after an attack. "The exposure vectors become greater with small businesses; they don't use [the servers] for just one thing," he adds.
And, as both Microsoft and Mr. Czernuszka point out, just updating the server isn't enough. Companies running applications that rely on Server 2003 will need to update those too, which can double the time needed to change systems. Microsoft's big push is to have customers move to its Azure cloud computing platform.
"When you move to the cloud, you never worry about when Toronto loses power, you never worry about Calgary flooding," says Jason Hermitage, vice-president of Operations at Microsoft Canada. For more than a year, he has been pitching Canadian businesses to upgrade to newer software, not least because Azure represents a monthly service fee for Microsoft instead of a one-time purchase, but also because the Redmond, Wash.-based software giant is moving to a set of constantly updating operating systems for desktop and data centre, instead of semi-annual releases. "This could be the last migration that they do."
Those migrations might not be cheap for cost-conscious small businesses. But Mr. Hermitage suggests the price of keeping an insecure and unsupported Windows Server 2003 after July 14 is just too high.
"I liken it to putting your wife and small kids in a 1920s car and driving it down the 401," he says, referring to Toronto's congested highway.
"Thirteen years in the technology space is an eternity … so much has changed, it's time to move on."