1

I have an SQL 2000 database server which is not supported by Microsoft anymore. We have our information security policy applied and even PCI requirements. What are the security risks that we might face in this case?

I could think of one example : Vulnerabilities. Can we fix any new discovered vulnerabilities if found on that server? Usually they're fixed by new patches or updates, but in this case i think that Microsoft will not provide any.

1 Answer 1

2

I could think of one example : Vulnerabilities. Can we fix any new discovered vulnerabilities if found on that server? Usually they're fixed by new patches or updates, but in this case i think that Microsoft will not provide any.

You just answered your own question. You will not get any security updates for new vulnerabilities discovered so you will always be at risk of new attacks. Microsoft's products are not open source so you cannot even try to fix any vulnerabilities discovered (although that would be a very stupid thing to do from a business perspective even if the product in question is open source).

The risks can be (somewhat) mitigated if the server in question is not Internet facing but why take the risk? Don't use unsupported products or products that are EOL.

2
  • So you're saying that vulnerabilities is my only concern (in this case) when using an unsupported product. And if i keep scanning the device regularly and no new vulnerabilities are found then i can keep using it Nov 25, 2013 at 13:06
  • @OptimusPrime That is a risk-based decision which depends on factors that only you can tell, such as budget, time, hassle and risk, which is very valid to a business. Just make sure your scanning software is updated regularly.
    – Lex
    Nov 25, 2013 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .