The System You're About to Retire Is Still a Door
This week a payments company disclosed that attackers reached customer data through a legacy card system. That system was already scheduled to shut down next month.
I'm not here to pick apart anyone's incident. The pattern is the lesson, and it shows up everywhere.
Why retiring systems get hit
Once a system gets a retirement date, it quietly drops off the list. The team is focused on the new platform. Patches slow down because "it's going away anyway." Nobody reads the logs. Service accounts and vendor logins stay active. And the data, often years of it, is still sitting there.
To an attacker, that looks like a side door with nobody watching. Retiring isn't retired.
Six moves, tactical to practical
Find them. List every system marked legacy, sunset, end-of-life, or "replace next year." Include the old file server, the previous ERP, the test environment that became permanent, and the app only one person still uses.
Give each one a named owner. Not a team. A person, accountable until the day it is fully off.
Keep patching and monitoring until it's gone. A shutdown date is not a reason to stop. If it can't be patched, isolate it and watch it more closely, not less.
Cut access now. Remove users who moved to the new system. Disable service accounts, API keys, and vendor logins it no longer needs. Require MFA on whatever stays.
Shrink the data. Move what you must keep under your retention rules. Delete what you don't need. Data you no longer hold can't be stolen.
Take it off the internet. If nobody outside needs to reach it, close it. If they do, put it behind your VPN or access gateway.
Shut it down for real
"Decommissioned" should mean something you can prove. Before you close the ticket, check:
Powered off or deleted, including cloud instances and snapshots
DNS records removed, so nothing points at an address someone else could pick up
Firewall rules and open ports closed
Backups and copies handled under your retention policy
Accounts, certificates, and keys revoked
Asset inventory updated, so it doesn't come back as a mystery box in two years
A 30-minute drill for this week
Pull your team together and ask three questions. What are our five oldest systems still running? Who owns each one, by name? On what date is each one actually off? If nobody can answer, you just found your next project.
Old systems don't get safer with age. They get forgotten. Make sure attackers aren't the only ones who remember them.
What's the oldest system still running in your environment, and who owns it?
Views are my own.
Comments