The importance of knowing your legacy systems

The importance of knowing your legacy systems.

With the legacy technology present across the UK’s Healthcare sector presenting a major cyber security risk, is a new approach to mitigating risk required?

With the legacy technology present across the UK’s Healthcare sector presenting a major cyber security risk, is a new approach to mitigating risk required?Contents

Thank you for reading our

The importance
of knowing your legacy systems

The importance of knowing your legacy systems

The level of legacy debt varies widely across the NHS and a recent report from the Department of Science Technology and Innovation (DSIT) has revealed that legacy technology can range from as little as 10 to as much as 60-70%. This reliance on outdated systems presents a significant cyber security challenge, heightened by the fact that 15% of surveyed organisations could not estimate the size of their legacy estate. The report also highlights that these systems are high-risk, prone to security vulnerabilities, lack support, and subject to operational failures.

The issue? Many NHS Trusts struggle with a clear view of their legacy applications and systems. Without this visibility they are challenged to understand and manage the systems which are often critical to their daily operations. In the absence of proper documentation and oversight, it's impossible to effectively secure these systems and they remain exposed to cyber threats.

To truly address security issues in legacy systems the correct foundation should be laid, and the right expertise needs to be on hand to support.

Why mapping is essential

Legacy applications serve essential roles, but their age and complexity make them vulnerable to security risks. Legacy assets and applications are also often large scale and mission critical. They are difficult to modernise due to long term data retention and because they are difficult to migrate notably to public Cloud environments. To do so, requires incumbent knowledge of that legacy platform and it relies on working out how you get the data exfiltrated from that environment and transferred to a new platform.

Knowledge and documentation are the first step to securing legacy systems. If you don't know what you have, you can't secure it. A foundational mapping exercise is crucial for establishing a baseline of assets and ensuring the identification of what needs to be secured.

Having sight of all legacy systems within the organisation allows health authorities to do their governance and supply chain risk analysis. From here they can make sure that they have supply chain security and that assets are properly patched and meeting Cyber Essentials and Cyber Essentials Plus certification.

This is the best practice for securing legacy applications in Healthcare, offering insights into strategies for modernising infrastructure while maintaining compliance with necessary security standards. Once authorities have mapped their systems, they can prioritise which legacy assets to update and which to continue managing, securely.

Mitigating risk and securing legacy systems

The next step is to put security measures in place that protect these systems from cyber threats. Replacing legacy infrastructure isn't always possible, so Trusts must find ways to strengthen their existing environment.

Security Information and Event Management (SIEM) services can help safeguard legacy systems by continuously monitoring traffic flows and flagging abnormalities that may indicate a cyber threat. This enables Healthcare organisations to detect suspicious activity in real-time, create security rules to combat any deviations and reduce the risk of breaches.

However, the effectiveness of SIEM relies on working with partners that not only offer monitoring tools but also understand the complexities of legacy systems.

It's essential to partner with organisations, like Exponential-e who can integrate these solutions into existing environments while ensuring compliance with the latest security standards. This level of expert assistance can also help Healthcare organisations to assess and develop security processes, strengthen postures, and educate staff. With the right support, NHS organisations can safeguard critical systems without compromising operational efficiency or patient care.

Compromise in security will undoubtedly lead to breaches. As we see a rise in sophisticated threats to Healthcare organisations in a heightened geopolitical environment, every NHS organisation and partner must work to proactively secure legacy applications to protect sensitive data and systems from breaches.