Information Security Statement on End-of-Life Operating Systems

Information Security requires that all devices connected to the campus network run vendor-supported operating systems for which security patches are available. Running an OS which is outdated substantially increases the risk to the University, including the campus network and University systems and data. These risks include: 

1. Security Risk - An end-of-life operating system is no longer supported by the vendor and will not receive security updates to protect against newly discovered vulnerabilities. Without these updates, systems may be vulnerable to exploit and will be targeted by hackers and malware.  

2. Compliance Risk - Running end-of-life software constitutes a compliance violation under various regulatory and compliance standards.  

3. Incompatibility - As changes are introduced to our computing environment, the focus of testing is on current operating systems. When running an outdated OS there is no guarantee that new applications will function as expected.  

4. Higher Support Costs - Running end-of-life systems may lead to higher support costs as staff attempt to keep these systems secure. These legacy systems may also represent a barrier to innovation, e.g. they could delay forward progress on changes in the environment which could provide a substantial benefit to the campus community. 

Information Security requires that systems running end-of-life operating systems be disconnected from the campus network entirely, or at minimum, blocked from internet access. 

Information Security constantly monitors the campus network for unauthorized access and regularly reviews vulnerability and threat reports, including systems running outdated operating systems. Information Security also regularly reports on system compliance to the Board of Governor’s Audit and Risk Committee.  

At present Information Security does not prevent systems running EOL operating systems from connecting to the University network. However, we will remove systems running outdated operating systems in the event that there is: 

• a security incident involving a system running an outdated OS; 
• a critical vulnerability disclosed against an EOL operating system that is actively being targeted; or 
• any other security event that occurs which puts the University systems or network at increased risk.  

As the end-of-life date approaches for your operating system, there are several options available to ensure your system remains secure and does not put the University at unnecessary risk. These options include: 

1. Operating system upgrade 

• For personally-owned computers, purchase and download a newer operating system and follow the instructions for installation. Students are entitled to receive Windows for Education at no charge and can be obtained from the Software Distribution site (https://guelph.onthehub.com/) 
• If your computer is managed by CCS, you will be contacted to have your system upgraded. 
• If your computer is managed by departmental IT staff, contact your departmental IT administrator.  
• If you aren't sure which operating system you are running or how to get support for upgrading, contact the CCS Help Centre IThelp@uoguelph.ca or Ext.58888) or contact your departmental IT administrator. 

2. Purchase a new computer 

• If you wish to purchase a new University-owned machine with an updated operating system, contact CCS Managed Desktops IThelp@uoguelph.ca or Ext.58888) or your departmental IT administrator. 

3. Pay for extended support 

• In some cases, vendors offer extended support and security updates for a period of time past the EOL date for an additional cost. Contact the CCS Help Centre (IThelp@uoguelph.ca or Ext.58888) or your departmental IT administrator. 

4. Remove it completely from the network 

• In the case of specialized equipment, it may be acceptable to simply remove the system from the network and run it completely in stand-alone mode. In these cases, contact the Information Security team to ensure this will protect the system and the network adequately. 

5. Mitigate the risk and request a security exception  

• There may be valid business reasons why an upgrade is not possible or may be cost-prohibitive for the University. Contact the Information Security team to review potential risk mitigation strategies. 

Migrating to a new operating system can be challenging and training can help smooth the transition. The University of Guelph provides access to LinkedIn Learning which offers a number of foundational training sessions for the most popular operating systems that may prove beneficial in the upgrade process. LinkedIn Learning is available at no cost for all students, staff, and faculty. More information on how to access LinkedIn Learning can be found on the CCS LinkedIn Learning service page. 

Users with questions or requiring assistance should contact the Information Security team via email (infosec@uoguelph.ca) or via phone at 519-824-4120 Ext. 58006.  

CCS Information Security 
https://infosec.uoguelph.ca