When it Comes to Legacy Software, Cybersecurity is a Lifecycle Issue
TL;DR: Legacy software can become a business liability long before it stops working. Modernization helps keep connected products maintainable, supported and resilient throughout their lifecycle.
This week’s cyberattack on refrigeration systems at more than 700 supermarkets in France – when hackers seized remote control of cooling units and hiked the temperatures as high as 122 F/50 C, spoiling food and potentially causing fires – offers a stark reminder of the risks associated with software that has aged beyond its support lifecycle.
The incident disrupted store operations, threatened food safety and cost grocers tens, if not hundreds, of thousands of euros. For companies that build and maintain embedded systems, industrial equipment, medical devices and other connected products, the lesson is clear. Cybersecurity is not just an IT issue, it’s a software lifecycle issue.
Software that once performed reliably can become a business liability when its underlying technology is no longer supported, security vulnerabilities go unaddressed, or modernization is repeatedly postponed. Understanding and planning for that risk before an incident occurs is essential to protecting products, operations and customers.
When Legacy Software Becomes a Business Risk
The incident highlights a problem that extends well beyond grocery stores: connected equipment can remain in service long after the software supporting it has become difficult to maintain securely.
In the event of a successful attack, equipment may stop functioning as intended, products may be lost, operations may be interrupted, and customers may lose confidence. Depending on the application, the consequences could be much worse than spoiled food, even extending to patient care, worker safety or critical infrastructure.
This is what makes legacy software such a persistent challenge. A system does not need to appear broken to be vulnerable. It can continue doing its job for years while the technology beneath it becomes increasingly difficult to secure. An unsupported operating system, an aging software framework, an unpatched firmware component or an obsolete communication library can introduce weaknesses that are difficult or impossible to address through routine maintenance.
Connected Products Need Secure, Supported Software
Embedded systems that once operated in isolation now connect to cloud services, enterprise networks and remote maintenance tools. While connectivity enables valuable capabilities, it also expands the attack surface.
A decade-old industrial controller may still work perfectly, but its operating system or supporting libraries may no longer receive security updates. Firewalls and network segmentation can reduce exposure, but they can’t fully compensate for software that is no longer supported.
Keeping embedded software up to date is rarely as simple as applying a patch. Updates can affect hardware compatibility, real-time performance and other tightly integrated components. For medical devices and other regulated products, changes may also require extensive testing and validation. These complexities can make modernization costly to postpone, but increasingly expensive to ignore.
Make Security Part of the Software Lifecycle
Cybersecurity must be considered throughout a product’s life, from architecture and development through deployment, maintenance and eventual retirement. That means tracking software dependencies, planning for security updates and knowing when platforms will reach end-of-support.
The goal isn’t to eliminate every vulnerability. It’s to ensure that the software powering connected products can continue to be maintained and secured as technologies and threats evolve.
Modernization is an Investment in Long-Term Resilience
According to Danish firm Danfoss, whose software powered the impacted units, many of the affected refrigerators had reached end of life. The company said it had advised customers to ensure they had the latest firmware and to migrate legacy systems to modern solutions.
That’s a lesson that applies well beyond this incident. When legacy software becomes difficult to secure, modernization offers a path forward. Depending on the system, modernization may involve migrating to a supported operating system, updating an obsolete software framework, replacing aging components, restructuring an application or moving to a more maintainable architecture. The right approach depends on the product's requirements, hardware constraints, regulatory obligations and expected service life.
At ICS, software modernization is part of helping companies extend the useful life of complex software products without remaining tied to aging technology. Our software modernization services include platform and framework migrations, embedded software development and related engineering work. The objective is to help organizations move to maintainable, supported foundations while preserving the functionality and investment embodied in their existing products.
Don't Wait for a Security Incident
The French supermarket cyberattack is a reminder that aging software can put operations, customers and business continuity at risk. Keeping connected products secure means planning for the entire life of the software, not waiting until outdated technology becomes a liability.
Are your products running supported software? Can you address newly discovered vulnerabilities? Do you have a plan to modernize systems that can no longer be maintained securely?
If you need help in any of these areas, reach out to us. Our cybersecurity and software modernization experts can help you develop and implement a strategy that works for your organization.