I recently saw a Windows 7 machine (virtually running in a Xen environment) and used in a production network to perform certain automated tasks.
This system was missing over a 100+ Windows update including critical security updates. The explanation that I got from the system administrator was that this system is only accessibly in two cases:
- Over the Xen console when connected to the management virtual private network (VPN).
- When connected to the production VPN over Windows Remote Desktop (RDP), using two factor authentication (2FA, Vasco Tokens) authenticating against an active directory (AD).
All servers in the production network are behind a Barracuda NG Firewall.
In his opinion that should do the job and updates are not required because the firewall blocks all incoming and outgoing internet traffic to and from that machine.
It feels unnatural not to update even when the machine is "isolated". So, does a virtualised Windows machine without internet access need updates and what are the potential risks when this machine isn't updated in this case?
Note: I allowed the firewall to let this machine connect to the Microsoft update servers in order to fetch a list of the missing updates. The in- and outgoing internet connections to/from this machine are all blocked in the firewall again.