ARLINGTON, Va.-Microsoft's discontinuation of service for its Windows XP operating system could cause security and compliance risks for credit unions.
The Redmond, Wash.-based software giant is ending support for XP on April 8, 2014, meaning no more regular security patches, technical assistance or support.
The Federal Financial Examination Council last week warned that FIs and technology service providers that use XP in PCs, servers and other purpose-built devices (such as ATMs) could be exposed to increased operational risks. Banks and CUs unprepared for the end of XP service will also face compliance issues.
At NCUA, Communications Specialist Ben Hardaway said the end of XP service will be of particular concern for CU ATMs because about 75% them currently use Windows XP. "The discontinuation of that operating system opens those systems up for viruses, cyber-security concerns, and then there's just simply an operations component that comes with a system that isn't being used anymore," said Hardaway. "It is a number of months away, but it is something that the regulators felt should be something on people's radar so they can begin planning for that conversion."
Dean Stewart, senior director for self-service product management at Diebold, said NCUA may be underestimating the percentage of ATMs running on XP, noting that Diebold and other ATM providers have been running their ATMs on XP since 2003.
Stewart noted that phasing out XP support is a natural part of the evolution of the product, and said similar moves have occurred with previous operating systems, which tend to have about a 10-year lifespan these days.
He said that Diebold has been discussing the end of XP support with clients for at least a year, including offering various educational components and webinars on how to deal with it. And ATMs aren't the only thing at CUs running on Windows XP. Many teller platforms, branch manager laptops and other systems will also need to be converted.
John Campbell, manager of the automated delivery systems department at Virginia CU, said most computer users are aware their operating systems have a lifespan, and so are used to updating internal computers as needed. Plus, many shops have IT staff to assist with that process. With ATM fleets, however, management may be in a different department or facility, and be of a different mindset. "More people are realizing an ATM is just a computer with a big tank around it," said Campbell.
The good news, he continued, is that because so many FIs already did the work to prepare for new ADA regs, many of them won't have to do significant hardware replacement or upgrades. "Now it's just the logistics of 'Is my network ready and when do I stage this out so that it doesn't impact service?'"
And as more CUs migrate their operating systems to Windows 7, there's another date to keep in mind-Microsoft is currently expecting to stop service on Windows 7 sometime around the year 2020.
