Windows XP 'D-Day' could hit small-business owners hard

In this tech savvy day and age, most businesses rely on computers to perform some aspect of the job. However, for small businesses, with less ready capital for new equipment, the computers they rely on could soon become a liability.

Released Oct. 25, 2001, the Windows XP operating system is nearly 13 years old, and Microsoft Corp. (Nasdaq: MSFT) has decided it’s finally time to put the once-popular system out to pasture.

The Redmond, Wash.-based company will officially stop supporting and servicing Windows XP and Office 2003 on April 8 – meaning no more automatic updates that help protect the system against security threats such as viruses, malware, Trojans and bots.

“It’s like having an unlockable window that is able to be opened from the outside,” said Cliff Meyers, a technology consultant at Nixa-based We Fix Em LLC.

The window, in this case Windows XP, still works, as does the computer that uses it, but the chances it will be broken into, or compromised, significantly increase after April 8.

“Having that kind of vulnerability should be a concern,” Meyers said.

According to Web analytics firm Net Applications, nearly 30 percent of desktops were still running Windows XP as of January. That figure doesn’t include machines that might be running off Windows XP Embedded, often developed on top of other software or applications such as phone systems, network-attached storage devices and keyless entry systems, while the customer isn’t even aware of it.

“Upgrading is just something else that small-business owners – the kind that wear so many different hats every day – don’t have time to deal with,” Meyers said, warning the outdated software can lead to trouble. “Many think, ‘It still works, so why replace it?’”

Liberty Technical Solutions LLC owner Scott Jones agrees it’s the lack of concern for risk exposure that has deterred some from upgrading.

“Business owners might say, ‘I’m not really concerned about the lack of support’, so they may opt to not worry about upgrading,” Jones said.

Meyers cautioned, though, that’s the wrong kind of thinking.

“It’s not that you don’t have problems now, instead there might potentially be problems in the future,” he said.

Ted Smith, owner of Ted Smith CPA LLC, said when he encounters a business owner with the “if-it-isn’t-broke-don’t-fix-it mentality,” he starts to ask questions.

“These questions normally take the form of: ‘What would it cost you if you left your office, factory, etc., doors unlocked at night and someone stole from you?’ and  ‘What would it cost you if your main production line machine was broken and didn’t work for a full day?’” he said.

“Once I get them answering the questions and starting to verbalize how these scenarios would cost them greatly, I then turn it to what I am really wanting to accomplish –  in this case, what if someone hacked all your customer data – what would that do to your business?”

Jones thinks the effects of having unsupported systems won’t, most likely, be immediate.

“I think it’s a lot like Y2K – a lot of hype and not a big deal right away,” he said. “I think we’ll see more of this over time, older systems being compromised at an increased rate, but nothing immediate.”

But in the wake of major retail security breaches, such as those at Target Corp. (NYSE: TGT), Michaels and Neiman Marcus, Meyers said out-of-date software might be more vulnerable than ever.

“The bad guys are just working (the software and operating systems) from the back end and not releasing it until the good guys have stopped releasing patches and upgrades,” he said.

The costs
Springfield periodontist Jody Vance updated his systems last year under Myers’ advisement.

“I look at software and hardware as another employee,” Vance said.

Having that mentality allows Vance to plan for technological upgrades every three to five years. “These kinds of upgrades are just part of the cost of doing business,” Vance said.

More than buying new machines and salvaging older ones by adding more RAM, Vance also changed servers, reconfigured his data backup system and added new hardware and software to new and existing machines. The total upgrade was roughly $13,000 during the course of the year for Vance’s 13 PCs and server.

While Vance had an upgrade plan in place, Jones said small businesses typically don’t have an information technology department to keep systems up to date. That’s where outsourced IT, such as that offered by Jones’ Liberty Technical Solutions and Meyers’ We Fix Em, come in.

Both Jones and Meyers said most of the time, it’s more cost-effective to buy an entirely new machine with an up-to-date operating system, software and applications than to strip an older machine of Windows XP and upgrade it to Windows 7 or Windows 8.

Hardware upgrades necessary to support a new operating system often start at $600 to $700 per terminal.

“The cost of installing, plus the time and productivity lost with the poor performance of the old machine, will trump the cost of new equipment,” Jones said, adding a new, faster and up-to-date machine costs about $1,000 with a three-year warranty.

CPA Smith, who underwent an upgrade from Windows XP last year, said he initially just wanted to upgrade the software.

“I fought (upgrading machines) for a while, but ultimately conceded and have never looked back. It was time to buy a new machine; I was just trying to be too cheap,” he said. “I was back up and running much quicker than had I attempted to do it my way.”

Smith warns business owners against taking a DIY-attitude when it comes to a sophisticated technology upgrade.  

“Too often business owners forget the business that they are in and they end up taking a bigger financial hit in lost productivity,” he said.

Meyers said, most often, an upgrade from Windows XP can be done without any loss of business in the form of side-by-side updates or weekend installs. Depending on the size of the business, how much is being updated, and if files will need to be copied and/or converted for the new operating system, the process could take a few weeks to a few months – which is why he says, “the time to update was last year.”

Compliance issues
Medical facilities and businesses with points of sale, such as retailers and restaurants, have more incentive to upgrade than other businesses – as having an unsupported operating system would put them in violation of fineable laws and regulations.

“I think you get into serious implications when you’re a medical facility and you have to worry about HIPPA violations,” Jones said.

Considering the Health Insurance Portability and Accountability Act, or HIPPA, requires patient information to be secure, having such information stored on an unsecured network or computer would be in violation of the law.

Meyers said retailers and merchants also would be in breach of Payment Card Industry security standards if they continue to use Windows XP for business transactions, which would result in a fine to the vendor that would increase substantially if cardholder information is compromised.

The transition to a new Windows operating system should have began months ago, Meyers said.

Microsoft agrees.

“If your organization has not started the migration to a modern desktop, you are late,” according to its website.

However, the not-broke-don’t-fix mentality, coupled with the time and financial budget constraints, have hindered many from upgrading and heeding the nagging from Microsoft and IT experts.

“Just last week, I heard Lynn Morris, owner of Family Pharmacy, say something that I think applies. We were talking about the cold and snow and he said, ‘When you are in retail and lose a day due to the weather, you don’t get it back,’” Smith said. “I think that comment is very valid here.

“The time people will lose by not upgrading and the potential business they will lose when there are serious problems, they won’t get it back. To me, it’s just not worth the risk.”