Good day everybody. My name is Garry and I’m an Infrastructure Manager working for a Government body here in the UK. I manage a small team of infrastructure and support engineers and it’s my job to ensure that our systems are reliable, resilient and efficient and that our network is stable and secure.
I’ll be writing for Neowin, concentrating on explaining the nuances of what working in a large organisation is really like. The news posted on Neowin and other technology websites is often in the form of product announcements, technological breakthroughs and press releases but often missing is an explanation of the consequences and what they mean to businesses and organisations such as mine. I’ll be attempting to explain what happens when the news leaves the front page and becomes something which IT managers, such as myself, have to deal with in the real world.
One question I often see asked by contributors to Neowin is why so many people, particularly businesses, are still running Windows XP and Office 2003. Quite often, it’s attributed to poor IT management or a lack of proactive thinking by the organisation. While I’m sure there’s some truth in that assessment I can assure you that the reasons not to upgrade often go much deeper.
Most businesses and organisations with a Microsoft licensing agreement gained access to Windows Vista in October 2006 yet recent estimates show that up to 60% of PCs worldwide are still running Windows XP. While this number is undoubtedly falling, some organisations steadfastly refuse to upgrade. Why? There is no single reason as each organisation is different and has its own requirements. For some, the issue is simple cost. My organisation, for example, buys PCs from Dell which include OEM versions of Windows XP Professional. Buying Windows Vista or 7 licenses would cost thousands of pounds, and that is without taking into account the costs of retraining staff, testing for compatibility, the lost time involved in performing the upgrades and tying up IT staff who could be working on other projects. Remember, in business, time lost is revenue not earned.
A sensible business will do an exercise to ascertain the total cost of such an upgrade and will only proceed if the benefits outweigh those costs. Windows Vista and 7 both brought new features which supposedly increase productivity and save time. When I talk about features I don’t necessarily mean obvious changes like the new ‘superbar’ but quite often more subtle things like increased security. Better security means IT departments spend less time cleaning up after virus outbreaks, or testing and rolling out patches. This can save IT departments a lot of time (and therefore money!) even before the benefits to end-users are assessed. It is not until the benefits begin to outweigh the calculated costs that an IT department should even consider upgrading their chosen operating system.
In some instances, however, it may be the case that an organisation with a software assurance agreement (which allows the organisation to use the latest version of a product when released) could upgrade their licenses at very little cost. If they don’t run any applications where compatibility is not assured and they can deploy the operating system easily, then the justification to upgrade should be pretty easy, right? Wrong. Many IT managers I’ve spoken to simply see little benefit in upgrading. Are Windows Vista and Windows 7 really much more stable and secure than a fully patched Windows XP system with up to date anti-virus and firewall protection? Can staff who spend most of their day writing e-mails, creating office documents and designing things in AutoCAD or looking at financial forecasts really get a lot more done more quickly? It would appear that most organisations are saying “No.”
In some organisations, little regard is given to security and risk but as I work in the public sector it is often the very first thing that is assessed, even before it is decided whether to look at costs and benefits. Many IT security managers are paranoid by their nature but, in my opinion, often have very little reason. I am told by my own IT Security Manager that it is ‘standard practise’ within the public sector to wait for at least the second service pack of a product before even assessing whether or not to roll it out. It is product releases such as Windows ME and Windows Vista, which both suffered terrible reputations when they were first released which have led to such reservedness. Many of you reading this article will be technology enthusiasts who will disagree with waiting such a long time after a product release (as I do), but many organisations opt to ‘play it safe’ unless there is an alternative. There are also many government organisations, agencies and external partners who offer conflicting advice on what’s deemed safe and what is ‘approved’ for use. The result of this confusion, certainly within the public sector who rely on such agencies: inaction.
Part of my role is to drive my organisation’s technology forward and I would personally love to deploy Windows 7. I believe I can construct a convincing argument to upgrade on the basis of cost/benefit and slowly but surely I am also becoming more able to win the argument of risk and security. Microsoft’s recent out-of-band patch release for Internet Explorer 6 shows that a product’s maturity does not necessarily make it more stable or secure. Furthermore, Windows Vista and 7 were created after Microsoft’s Trustworthy Computing initiative was launched and were designed, from the ground up, to be inherently secure; which is demonstrated by the small number of security patches Microsoft have had to release, particularly for Windows 7.
Given the difficulties in convincing senior managers, CIOs and security managers to upgrade their desktop architecture it is little wonder that Windows XP remains a staple product within many organisations. I fear that only being forced to upgrade (by a lack of drivers or support for newer models of computer) will be enough to persuade some organisations’ decision makers to take the plunge.
This is, of course, only my opinion from years of personal experience. Thank you for reading and I look forward to hearing your own thoughts and experiences.
