Legacy System or Out of Date System: What is the Difference?
As Information Technology has evolved over time and has become a core foundation for several corporate processes and workflows, a dichotomy has been formed between IT systems, with regard to newer, more efficient systems, and older, legacy systems. Legacy Systems have become a common occurrence within the modern IT ecosystem associated with small, medium and large enterprises, and, according to Computer Weekly, many legacy hardware and software systems from HP, IBM, etc. are still used by banks, the travel industry, and the public sector. Such systems have come to be synonymous with old or out of data systems, yet it is important to understand that there are key differences between legacy systems and old systems.
Though it is difficult to pinpoint an exact definition of legacy systems, such systems typically have a few, common characteristics, such as being based on outdated technology, being incompatible with current systems, being unavailable for purchase from vendors or distributors, etc. That said, a legacy system can simply be defined as a system that is no longer supported or maintained by its developer/vendor, and can thus no longer be updated or patched automatically. This is an important note, since, it is possible for an IT systems to be considered a “legacy system” even if it’s only one year old. At the same time, it is possible for a system to be 10 years old and - if it is still supported/maintained and available for purchase - not be a true legacy system. Thus, a legacy system is not necessarily an outdated system, and an old system is not always a legacy system. The key differences between legacy systems and outdated systems are important as they help to highlight how each system can affect an enterprise, and how each system should be dealt with to better the productivity and efficiency of the business.
Per the above, it is also important to note why systems become legacy systems, exactly how they affect a business, and how such systems can be upgraded to a modern infrastructure. Depending on the IT infrastructure, a hardware system may be based on outdated, old technology that is no longer available, which can result in it becoming a legacy system. With the current trend of technology quickly evolving on a yearly basis, enterprise hardware systems typically need to be modernized in order to keep up with the demands of a technology and data-driven, progressive world. Additionally, IT systems may, over time, become incompatible with newer, modern software systems or platforms that enterprises need to run, resulting in a compatibility issue. Another common issue resulting in a system becoming a legacy system is the closing down of the business or vendor that developed the system, which results in a lack of support, and a lack of maintenance and/or security patches.
There are several reasons why corporations and enterprises of all sizes continue to use legacy systems. Essentially, such systems are usually critical to the daily operations of the enterprise, while, according to BusinessDictionary, a legacy system is an “obsolete computer system that may still be in use because its data cannot be changed to newer or standard formats, or its application programs cannot be upgraded.” While it is often more cost efficient to upgrade or replace legacy systems in the long-term, there are some solutions that can be implemented to allow an enterprise to continue using a legacy system. Yet, even with such solutions, legacy systems often present enterprises with more problems than solutions, including critical problems such as a lack of data security.
Which Business Systems Can Become Legacy Systems?
Modern small, medium and large businesses utilize a variety of hardware and software systems in order to manage and complete a variety of daily operations. Such IT systems include servers, smartphones, computing workstations, operating systems, network peripherals (routers, switches), Enterprise Resource Planning software, financial/accounting applications, data analysis applications, and more. Each of these systems (and all such enterprise IT systems) have the capability to become legacy systems. Thus, it is important to recognize how each system can affect an enterprise when, or if, it becomes a legacy system, and what to do about it.
Typically, new systems require new devices or hardware platforms that are compatible with the system. This rings true for both hardware systems and software platforms. When it comes to the core software by which a computer runs - its operating system (OS) - a legacy OS may present a business with a critical disadvantage if their OS is unable to run new, updated software that is needed for their daily operations to be completed efficiently. For instance, some enterprises continue to utilize Microsoft Windows XP as their OS for their workstations or servers. This entails several things, such as the fact that the OS is no longer supported or maintained, resulting in the utilization of an OS that lacks key security patches. Such a situation also means that the enterprise will be unable to use newer Microsoft products, since such newer products are usually compatible only with newer versions of the Windows OS. The enterprise can upgrade the OS on the computer system, but if the underlying hardware is a legacy system as well, then it may not support a newer version of the OS, tying the enterprise to the utilization of an outdated hardware - and software - system.
Internal Software Applications
As noted above, internal software applications can include any enterprise software package, suite or set of applications. This typically includes Enterprise Resource Planning (ERP) suites, finance and accounting software, Customer Relationship Management (CRM) applications, data analysis/business intelligence programs, and more. Such software packages are usually critical to the daily operations of an enterprise. Likewise, such software systems can become outdated and, eventually, unsupported by vendors and developers. When this happens, such software applications have become legacy systems/applications, which can result in several undesirable outcomes, including:
- Slow, inefficient performance
- System crashes and/or security holes
- Lack of integration with newer systems
- The requirement for specialized (typically outdated) skills for complete utilization of the system
- The requirement to use specific devices (with the system) that are also outdated and/or unsupported
- Lack of mobile support
For the latter, a Red Hat survey revealed that 89 percent of businesses that were assessed indicated that they had formulated a mobile strategy for their enterprise, even if only partially. Legacy systems often fail to keep up with the evolution of technology (including newer devices, such as smartphones and tablets), which can strain the business strategy of an otherwise competitive enterprise.
While outdated enterprise software systems are often overlooked, hardware systems are often the core systems that are regarded as being synonymous with the term “legacy system.” This is because the underlying hardware of an IT infrastructure often dictates what software systems can be run in order for an enterprise to manage and complete their daily operations. That said, legacy hardware systems often include computer systems with older Central Processing Units (CPUs), or 32-bit architecture (as opposed to 64-bit architecture) - thus limiting the amount of RAM that the computer can utilize - along with the firmware/BIOS that the system uses, etc. For the latter, the type of booting system that is utilized may make it impossible to install and/or boot certain types of operating systems, such as certain Linux distros or newer versions of Windows. Additional legacy system factors can include an outdated system that utilizes pre-USB ports (i.e. IEEE parallel ports or PS/2 ports), older system bus-architectures, or outdated, obsolete processing systems (i.e. Pentium II system).
Per the above, network systems (including network routers, servers, hosts, workstations, switches, and even network/encryption protocols) are often overlooked when legacy systems are spoken about. Yet, when compared with other types of legacy systems, network systems are equally significant to the running of an enterprise, largely due to the modern importance of telecommunications and data communications. That said, there are a variety of examples of network legacy systems, network legacy security systems and network systems that are not yet true legacy systems, but are outdated to the point of becoming legacy systems very soon, including:
- 802.11b WiFi standard - an older WiFi standard associated with obsolete network devices that are no longer supported. 802.11b was replaced by the newer standards 802.11g and 802.11n.
- SMBv1 network file-sharing protocol - implicated as the vector for the WannaCry ransomware, and may soon be a legacy protocol.
- SSL encryption (replaced by TLS)
- WEP WiFi security (replaced by WPA and WPA-2)
- ARPANet (the precursor to the modern Internet)
- Systems Network Architecture (SNA) from IBM
It is important to note that, typically, legacy network systems are directly correlated to insecure data transmission and modern ransomware/malware attacks. Thus, while it is not always necessary to upgrade hardware and software legacy systems, it is typically critical to upgrade network legacy systems in order for enterprises to ensure complete data security.
Identifying a Legacy System in Your Business
Legacy systems are often used continually in order to reduce costs associated with an upgrade or system replacement. This is true even when newer systems exist. That said, it is important for enterprises to conduct system performance and security audits to determine whether legacy systems exist amongst their IT infrastructure, and whether it is cost-effective to utilize such systems as opposed to upgrading/replacing them. That said, end-users/clients utilizing legacy systems are often at risk of being the victim of a security breach or hack, since such systems no longer receive security patches or updates. Additionally, such systems often lack the functionalities that newer systems come pre-packaged with.
More importantly, while many enterprises erroneously believe that they are saving money and overhead by using legacy systems instead of upgrading, such systems - which are often prone to breaking down, crashing or not operating at peak efficiency - often require more money for routine maintenance, training of personnel with specialized skills (in order to utilize the obsolete system), and for the utilization of extra systems that fill in the gaps with functions that are lacking with the legacy system, while allowing the business to operate effectively on a daily basis. Essentially, legacy systems often have higher maintenance costs, along with having a greater frequency of system crashes, data breaches and/or data loss issues, while also having lower performance, lower efficiency, and a greater number of technical limitations.
Thus, attempting to identify whether a business is using legacy systems - and how such systems affect the enterprise - is an important step in maintaining optimal business efficiency.
Year of Creation, Introduction or Implementation
When determining whether an enterprise is utilizing legacy systems, for identification purposes, typically an IT specialist would look first at the year of the system’s creation, introduction, or implementation. As has been noted, a legacy system is not simply an “old” system, but at the same time, most legacy systems are outdated, obsolete and old systems. Identifying the year of creation/implementation helps to determine one of the primary factors commonly associated with systems that are no longer supported by vendors - age.
Current Performance Levels
As has been noted before, legacy systems are often greatly disadvantageous to enterprises due to such outdated systems performing poorly. To be specific, such systems often run obsolete hardware systems along with outdated software, which results in poor efficiency and performance, which ultimately creates an environment of lowered corporate efficacy and productivity. That said, it is thus important for enterprises to audit performance levels of key IT systems, in order to ensure that all systems are operating at optimal levels.
No Software Updates Available Anymore
Since legacy systems are software/hardware systems that are longer supported, one key indicator that a hardware or software system is a legacy system is the absence of current support, patches, updates, and/or maintenance being readily available. If no software updates/support is available, then the system in question is likely a legacy system.
Termination of Vendor Support
In line with above, the absence of vendor/developer support associated with a given software or hardware system usually entails that the system in question is a legacy system. This often happens when a company has cut support for an older product and has decided to focus on a newer product. Also, often the vendor/company associated with a system no longer exists, such that another key indicator of whether a system is a legacy system or not is related to the current status of the vendor or system developer.
Adding Additional Functions is Complicated or Impossible
Since obsolete, legacy systems were designed (typically) with specifications that were meant to meet the needs of a past technology era (even if that era is only a few years ago) - since technology evolves quickly - the system may be extremely limited in its functionality and ability to add new modules or functions. This is because such systems are often not compatible with any current technology due to being based on older, obsolete technology. This means that it is typically difficult or impossible - or simply overly complicated and costly - to add extra functionalities to the system.
In addition to above, whether the system is tightly coupled or loosely coupled is highly significant with regard to whether it can be customized. Tightly coupled systems typically have proprietary, interdependent components that cannot be feasibly replaced/altered in order to allow one to customize (or add to) the system. Such a system is more associated with older, legacy systems. Modern system architecture is often characteristic of loose coupling, which allows one to alter or customize parts of the system in a feasible manner while keeping the integrity of the system, which allows enterprises to customize the system in order to fit their specific needs.
Deciding When to Upgrade Legacy Systems?
Upgrading a hardware or software legacy system is a complex process that usually entails using a phased approach to first decide whether a complete replacement of the system is necessary, or whether parts of the system can be integrated or updated, where the rest of the system is then replaced with newer systems. That said, four key steps for upgrading a legacy system are as follows:
- Security Assessment
- Infrastructure Performance Assessment
- Financial Assessment
- Opportunity Cost Assessment
However, it is important to recognize that, with regards to hardware and software legacy systems that have compatibility issues with modern systems, virtualization/emulation is sometimes a solution. While hardware emulation allows a system to emulate a certain hardware chipset and/or architecture in order to run certain platforms, software emulation allows an enterprise to run an appropriate operating system (via virtualization) that can allow them to run the most effective software solutions. That said, it is important to determine whether emulation is a viable solution, or whether an upgrade is necessary.
Assess Whether the System is Secure
Determining whether an enterprise’s legacy system (which is often lacking in security patches) is secure is one of the most important assessments that should be made in the initial stages of legacy system auditing. As has been noted, this largely includes both software systems and network systems that may utilize outdated network security protocols, standards and/or security controls. A thorough security audit of the legacy system is the first major phase associated with determining whether to upgrade a legacy system.
Does Your Business Have Certain Compliance Obligations?
Per the above, determining whether a legacy system’s security posture aligns with all pertinent legislations (associated with an enterprise’s required corporate-compliance laws) is of the utmost importance. Complying with data security and privacy legislations such as PCI-DSS, Sarbanes-Oxley and HIPAA may require that an unsupported, unpatched legacy system be replaced in order to ensure complete data security.
Assess Current Levels of Performance - Does the System Still Meet Your Needs?
One of the most important factors associated with upgrading a legacy system to modern technology is the cost of the upgrade, the time-factor associated with upgrading, and how much overhead is required to complete the upgrade. Specifically, this includes the required time for the planning and implementation of the upgrade process, the overhead required for continuing daily operations during the upgrade process, the requisite training and/or hiring of specialized personnel to work on the legacy system upgrade, and an assessment of how much money is being saved - and/or spent - to finish the upgrade. While it may seem costly and time consuming to upgrade or replace a system, depending on the limitations of a legacy system the ROI could be significant.
Assess the Opportunity Cost of Not Upgrading
When determining the cost of upgrading a corporate legacy system, it is important to carefully evaluate the short-term and long-term opportunity costs of not upgrading. As has been noted before, it is possible to forego a full upgrade while maintaining the efficiency of a legacy system, such that a costly upgrade/replacement may be unnecessary. A thorough assessment of all cost and time-factors associated with upgrading versus not upgrading should be carried out by a knowledgeable analyst.
Modern IT infrastructures are core components of many small, medium and large enterprises. As technology quickly evolves, it is important for enterprises to implement, maintain and utilize up-to-date systems. However, often systems in use become outdated and fall under the category of being legacy systems. Such hardware and software legacy systems are often critical systems that are needed for the enterprise’s core, daily operations. That said, it is necessary for IT specialists to identify any existing legacy systems that an enterprise uses, and to determine if - and how - the legacy systems should be upgraded. Such a determination requires careful assessments of the corporate infrastructure and a carefully crafted plan for the future of the IT systems.