How does legacy show up in incident response investigations?

Legacy has played prominent role in many incidents handled by Northwave’s Computer Emergency Response Team (NW-CERT). But, legacy is often not the cause. Most incidents still start with ransomware, compromised accounts, phishing or human error. Legacy, however, does shape the incident. It can increase the impact, complicate recovery, and make it harder to rebuild and harden the environment safely. During an incident, legacy suddenly becomes a much more urgent problem than it seemed the day before.

Why attackers love legacy systems

An attacker may get in through phishing, stolen credentials, a misconfiguration or a vulnerability somewhere else. That said, legacy systems often have a more central position in the network than organisations realise. They support critical business processes, rely on outdated protocols or authentication mechanisms, or form the bridge between modern IT and older IT or OT infrastructure. For an attacker, that is an attractive target. Outdated software, limited security options and broad network access make legacy systems easier to abuse. An attacker can use them to strengthen their foothold, collect information and map out further routes. And when a system talks to multiple IT or OT environments, it makes a perfect stepping stone for lateral movement: the technique attackers use to move through a network after initial access.

“The worst moment to discover why a legacy system hasn't been replaced for years is when an incident forces you to do it tomorrow.”

The recovery dilemma

Legacy becomes visible again the moment containment and recovery start. The obvious reaction is: "we don't want this system back in the restored environment." An incident often acts as an accelerator to remove or replace legacy.

But that is where the dilemma begins. The reasons the system couldn't be replaced for years don't disappear because of an incident. It may be essential to a production process. It may depend on software or hardware that is no longer supported. Knowledge and documentation may be missing. A migration that wasn't feasible for years suddenly must be solved under the pressure of a cyber crisis.

Hardening the restored environment is a challenge too. Measures that are standard on modern systems, such as stronger authentication, tighter segmentation, modern security tooling or extended monitoring, are not always supported by legacy. Our CERT must then find a balance with the organisation between the security level they want and what is technically and operationally possible.

This is especially true in connected IT and OT environments, where simply switching off a legacy system can have major operational consequences. Recovery becomes a trade-off between getting the business running again and returning to an environment we can reasonably trust.

You found legacy

Now what? First, don't panic. Not every legacy system has to be replaced immediately. Segmentation, strict access control, additional monitoring and tested recovery procedures can reduce the risk considerably, as we described in our second blog in this series.

The starting point is awareness. Know which legacy systems you have, what they depend on, and what should happen to them during a major incident. In OT especially, that means looking at the industrial environment itself: the machines, the PLCs, the panel PCs and the spares in the storeroom, not just the IT network around it.

From a CERT perspective, legacy management is also incident preparation. Legacy doesn't have to be the reason an attacker gets in, but it can largely determine what happens next.