In October 2016 the FCC approved rules that would prevent ISPs from gathering that data and reselling it without consumer consent, and yesterday the US House of Representatives overturned those rules, The bill is now headed to the White House, where President Trump is expected to sign it.

Internet users are right to be concerned: Without those restrictions in place, everything you do on the web can be tracked, collected, stored, and sold without your permission. That isn’t just a problem for those tired of intrusive advertisements—it’s also a potential treasure trove for hackers.

It can’t be that big a deal, right?

Every time you open a browser window—incognito or not—your ISP knows what you’re doing. Each web request you make first goes through your ISP, giving them a record of every site you visit.

So, if you visit WebMD they know it. And if you navigate to the page on (insert embarrassing medical condition here) they know it. Suddenly you start seeing ads for creams, tinctures, and pills designed to treat that embarrassing condition everywhere you go, and guess what? It’s not a coincidence and it made someone money.

It’s alarming to think that your ISP is using your browsing history as a means to make more money, and it’s even more alarming to think what could happen to that data in the case of a data breach. Those advertisers just want to sell you embarrassing creams. Hackers want to trade your data for cases of the stuff.

It’s easy to protect data on the web, right?

Browsing the web is a lot like going out in public: There are certain things you simply can’t do without someone noticing. In this case the entity noticing is your ISP, and the things they notice are worth big dollars to other companies.

The most common method of anonymizing browsing habits is using a browser’s incognito mode, but that really isn’t hiding anything: All it does is prevent the computer you’re using from storing data-the traffic to and from your computer is fair game for anyone looking.

Ad blockers, script stoppers, and other plugins only protect your embarrassing browsing history from your friends and family. Your ISP still has access to everything you do. True protecting is difficult and comes with drawbacks but it is still possible.

How to protect yourself from the prying eyes of your ISP

There are a lot of reasons to want to anonymize your presence on the web, and not all of them are nefarious or illicit. If you want to stop your ISP from potentially selling your personal info here are a few things you can do.

1. Use ToR: There are many articles on Tor Browser and for good reason, it works. That doesn’t mean it’s easy to set up or get used to, though. One more reason not to rely on ToR for daily browsing is that lots of websites block ToR traffic because it’s impossible to monetize.
2. Use a VPN: Virtual private networks are sort of like ToR, in that they relay your traffic through a bunch of servers before spitting you out at your destination. The free ones aren’t that good, however, and the good ones are far from free. Expect slower browsing speeds too: All that rerouting takes precious milliseconds.
3. Consider local ISPs: Some of the biggest lobbyists for the repeal of regulations protecting consumer data are ISPs like Comcast and Verizon—they stand to make billions in targeted ad deals. Some small-scale local ISPs have said they won’t collect or sell data, so take a look at them if you’re looking for a new provider.
4. Research: If you’re curious about your ISP’s position on data gathering look into it. Call, email, or check out their website and if you don’t find an explicit statement saying they don’t collect or sell data it’s safe to assume they will.

The safest way to browse the web is, unfortunately, not to do it. In today’s age that’s practically impossible, so until internet traffic is safe you’re going to be hard pressed to find easy ways to protect yourself.

The three things you should consider:

1. The US House and Senate have both voted in favor of repealing regulations that prevent ISPs from recording and selling web browsing data and other personal customer information.
2. That information is sold to companies for targeted ad creation, but it could also be stolen by hackers.
3. Anonymizing your presence on the web and protecting your personal information is tough, but it can be done through the use of ToR, VPNs, and good research.

To most enterprise professionals, especially those working in IT, it’s understood that phishing is still a common threat. However, 85% of those surveyed for this report said that they had been the victim of a phishing attack in 2015, up 13% from the year prior. Additionally, 60% felt that the rate of phishing attacks had increased, on the whole.

Because of these attacks, 42% of those surveyed said they had suffered malware infections, while 22% suffered compromised accounts and 4% lost data. The most popular phishing campaigns were ones that employees expected to be in their inbox at work, like a document from HR. In fact, the report noted that an “urgent email password change request” had an average click rate of 28%. However, employees showed more caution with “consumer” emails for gift card offers or social network notifications.

The Wombat report also said that targeted phishing attacks, also known as “spear phishing” grew in 2015 as well. Of respondents, 67% reported experiencing spear phishing in 2015, up 22% from the year before. Compared to emails with no personalized present, emails with the employee’s first name had a click rate 19% higher, and those with an employee’s last name had a click rate of 17% higher.

So, which industries suffered the most? Telecommunications took the top spot with 24% click rate and professional services, which Wombat classified as consulting, law, and accounting, was a close second with a 23% click rate. Government came in third place with a 17% click rate for phishing attacks.

Plug-ins used by employees also increased the risk of attacks, due to the fact that many are often outdated. According to the report, here are the top four most outdated plug-ins:

1. Adobe PDF (61%)
2. Adobe Flash (46%)
3. Microsoft Silverlight (27%)
4. Java (25%)

To protect against attacks, 99% of respondent said they utilize email spam filters, 56% said they employed outbound proxy protection, 50% use advanced malware analysis, and 24% use URL wrapping. Additionally, 92% said they train their employees to recognize and avoid phishing.

Those familiar with the space will note that the report was previously put together by the company ThreatSim, who Wombat acquired late last year. This year’s report was compiled by both of the companies, who looked at millions of simulated phishing attacks sent through their platforms between October 1, 2014, and September 30, 2015.

The report also includes data gathered from a survey sent to Wombat’s list of security professionals (both customers and non-customers). While a specific number of responses wasn’t provided, the press release did mention that they received “several hundred responses.”

An additional report published by Wombat Security Technologies and The Ponemon Institute in 2015 put the total extrapolated cost of phishing at roughly $3.8 million for a 10,000 person company.

Three big takeaways

1. Phishing continues to grow with 85% experiencing a phishing attack in 2015.
2. Phishing templates that look like a corporate email are more successful than those that look like consumer emails, and personalized emails get a higher click rate from employees.
3. Outdated plug-ins increase vulnerability to phishing, with the top culprits being PDF, Flash, Silverlight, and Java.

What are your plans for dealing with phishing attacks?

PWC rightly points out that cyber security has become a persistent business risk and that threats (both to the economy and intellectual property) are on the rise. The report goes on to identify some very troubling incidents, including:

• More than half (53%) of global securities exchanges have experienced a cyber attack (IOSCO Survey)
• In South Korea, some 105 million payment card accounts were exposed in a security breach (Symantec Corp)
• City officials in Verden, Germany announced the theft of 18 million email addresses, passwords and other information (TechWeek, Europe)
• Cyber thieves stole more than $45 million from worldwide ATM accounts of two banks in the Middle East (CNet.com)

While the above mentioned compromises prove to be just a small fraction of the security incidents that occurred in 2014, those incidents do reveal some of trends, namely that financial gain is a key motivator for attackers and that even the most secure organizations are still susceptible to threats, two realizations that should be game changers for those seeking to protect IT assets from cybercrime.

Is the victim at fault?

When it comes to cybercrime, the complacency of the victims is sometimes at fault. While that does not excuse the criminal nature of the attackers, it does highlight the need for organizations to be proactive in protecting their assets – after all, the law only comes into play after a crime has be committed, meaning that the numerous anti-cybercrime laws on the books hold little sway against determined cybercriminals.

In other words, organizations should be taking a defensive position and grid themselves for attack as inevitability and as not an exception to the rule. That ideology will prove to be a key factor in the paradigm shift needed to protect against the onslaught of attacks expected in 2015.

PwC is forecasting that global security incidents are on track to grow some 48% in 2015, which should strike a dissonant chord with the majority of security professionals.

Is risk management the answer?

With the idea of a security paradigm shift on the table, today’s cyber-defenders should be thinking in different terms than just traditional security initiatives, shifting their focus towards an ideology of “cyber risk management”, which is being fueled by an initiative founded by the NIST.

The NIST has set forth a security framework (NIST Cybersecurity Framework) that stresses management over technology and highlights several best practices that should help organizations defend against the imminent threats posed by increasing cyber-attacks. While some of the elements of the framework fit under the realm of accepted best practices and common sense, there are other elements that encompass a sea-change on how organizations deal with cyber threats, namely in the core ideology of five concurrent and continues functions that provide a strategic view into the lifecycle of an organization’s management of cyber security risk. Those functions include:

• Identify: Build an institutional understanding of cybersecurity risk to organizational systems, assets, data and capabilities
• Protect: Develop and implement the appropriate safeguards, prioritized through an organization’s risk management process, to ensure delivery of critical IT capabilities without compromises
• Detect: Build the appropriate systems and policies to identify the occurrence of a cybersecurity event
• Respond: Create and implement the appropriate activities, policies and events that must occur if a cyber-security event occurs
• Recover: Develop and implement the appropriate activities, prioritized through the organization’s risk management process, to restore the capabilities or critical infrastructure services that were impaired through a cybersecurity event.

While the NIST states that its methodologies and best practices are optional, the organization does make a strong case for those looking to benefit from a holistic approach to cyber security, and at the very least, sheds some light on what should be an important conversation within any business relying on cyber capabilities to conduct business.

Those charged with the management of enterprise cyber security must delve deeper into what makes up an enterprise’s cyber security ideology and make appropriate adjustments before disaster strikes.

What Is Net Neutrality?

Net neutrality is the proposition that all data traveling through the Internet should be treated equally by all Internet service providers. This means that no company should be allowed to pay for premium access, nor should any company be penalized for failing to pay for premium access.

This principle was enshrined in the early days of the Internet when massive bandwidth hogs like Netflix or Hulu didn’t even exist, and that’s why some Internet service providers want to change the rules. For example, some Internet service providers might want the ability to slow downloading times for content providers that are also a competitor of theirs. Still, Net neutrality has remained the unofficial law of the land even in an era when two services (Netflix and YouTube) account for nearly half of all Internet traffic.

So What’s Changed?

Three years ago, Verizon Communications filed a suit against the Federal Communications Commission regarding a 2010 ruling that required broadband services to uphold Net neutrality. Verizon argued that the FCC had no authority to regulate Internet traffic in this way. The recent federal court ruling found that the FCC does have the authority to regulate Internet traffic, but that the FCC based its ruling on a law that doesn’t apply to broadband providers. Last month the FCC announced it will not appeal the case. Instead, it plans to create a new set of Net neutrality rules.

What does this mean for you? Perhaps nothing — at least in the short term. You can continue to use the Internet as you always have and anticipate that your content will be served up by your ISP without discrimination. But in the long term, the impact is unclear. In theory, broadband providers could start charging heavy bandwidth users like Google or Netflix to use their services. It also means that you might be able to buy premium Internet access that delivers content from these providers faster, with less buffering — but this is the access you currently have without paying extra.

For now, it’s a game of wait and see. Or, if you feel passionately about preserving Net neutrality, you can find ways to take action through the Save the Internet initiative spearheaded by Freepress.net.

What is your thought?

Back in 2010, a company called Quest Visual debuted a little app called Word Lens. It scarcely seemed possible, but the app translated a number of different languages in real time using just the smartphone’s camera. When traveling in a foreign country, Word Lens users would simply hold the phone up to a sign and the camera would immediately translate it.

Currently, users can translate between English and Portuguese, German, Italian, French, Russian, and Spanish.

It’s easy to see why Google would want to own it — its stated mission is to make all the world’s information searchable in any language — and Google Translate generally does this quite well, at least for web pages.

With Word Lens, iPhone users can translate the world. Apple even featured the app in its recent “Powerful” television ad for the iPhone 5s, and it’s obvious why.

Even better, it doesn’t require a connection to the internet, which is another benefit for business travelers.

Word Lens isn’t perfect. It has trouble with particularly stylized text or handwriting, and the translations will make occasional mistakes. However, most of the time, it will at least get the point across.

No financial terms on the acquisition, which was announced on Quest Visual’s website, were disclosed. Neither company shared details on what the future holds for Word Lens either, other than the website saying that the app and language packs would be “free to download for a limited time,” while the Quest Visual team transitions to Google. Individual language packs previously cost $3 each.

The app itself is free to download from the App Store for both the iPhone and iPad, and I couldn’t recommend it more highly. The translations are available via an in-app purchase, though they are currently free. It’s also available on the Google Play Store for Android users.

Word Lens is truly one of the killer apps for mobile, and it should be a staple on every phone.

Because we don’t know how long Word Lens will remain on the stores, I recommend that you pick it up as soon as possible, particularly if you travel internationally.

In an announcement, Leslie Nobile, Registration Services Director for ARIN which oversees the assigning of Internet addresses for Canada, the United States, and much of the Caribbean, said, “ARIN is down to its final /8 of available space in its inventory and has moved into Phase Four of its IPv4 Countdown Plan. All IPv4 requests are now subject to Countdown Plan processes, so please review the following details carefully.”

What that means is if your company needs IPv4 addresses, you’d better request them sooner than later.

Nobile explained, “All IPv4 requests will be processed on a “first in, first out” basis; all requests of any size will be subject to team review; and requests for /15 or larger will require department director approval. ARIN’s resource analysts will respond to tickets as they appear chronologically in the queue. Each ticket response is treated as an individual transaction, so the completion time of a single request may vary based on customer response times and the number of requests waiting in the queue. Because each correspondence will be processed in sequence, it is possible that response times may exceed our usual two-day turnaround.” For more details on the process see the ARIN IPv4 Countdown – Phase 4 page.

Even now you may not be able to get all the addresses you want, Nobile wrote. ARIN may experience situations where it can no longer fulfill qualifying IPv4 requests due to a lack of inventory of the desired block size. At that time, the requester may opt to accept the largest available block size or they may ask to be placed on the Waiting List for Unmet Requests.”

When asked, Owen DeLong, ARIN advisory board member and major IPv6 ISP Hurricane Electric director what this all means. He explained that ” 1 /8 in the free pool” means that there are now less than 16.7-million IPv4 addresses left for North America.

DeLong went on to say, “It means IPv6 deployment is now more urgent than it was yesterday, as it has been each day since over a decade ago we first realized we were going to run out of IPv4 addresses.” Further, “It means we are still on track for ARIN to likely run out of IPv4 addresses in the free pool by the end of this year, or possibly even sooner.”

There is some good, albeit not that good, news on the ever-shrinking IPv4 address pool. Incognito Software, a global provider of broadband device provisioning and IP address management found in its recent IPv6 Readiness survey of ISPs that while only a small percentage, 14 percent, of respondents are IPv6-ready, while 41 percent are midway in their transition to IPv6. However, “even fewer are offering IPv6 to their end-users, due in large part to challenges operators face with infrastructure upgrades, compatible device support, and customer education.” Nevertheless, “the survey found that three-quarters of respondents do recognize the importance of IPv6 and have begun planning for it within their organizations.”

Akamai, the major content delivery network (CDN) provider, stated in its Fourth Quarter, 2013 State of the Internet Report, that while the United States and some European countries continue to lead the world in terms of IPv6 adoption, and the rate of adoption was increasing, even the country that’s taken to IPv6 the quickest, Switzerland, only has 9.3 percent of its traffic on IPv6. The Untied States, which ranks number five in the world, only uses IPv6 for 5.2 percent of its overall Internet traffic.

In short, we’re running out of old-school IPv4 addresses faster than ever and the need to move to IPv6 has never been more urgent.

In Closing:

ARIN, which oversees the Internet addresses for Canada, the United States, and much of the Caribbean, is down to its last few IPv4 addresses. Are you ready to convert to IPv6? You’d better be. The IPv4 clock is ticking.

With less than two months left until Microsoft officially ends support for Windows XP, the operating system still has nearly a third of the desktop market, according to NetMarketShare.

What if cost wasn’t a factor?

The most common way for businesses and individuals to get a new operating system is by purchasing a new PC. There are many updates and patches developed for the OS over the years, but when the next major version is developed, you traditionally either buy a new PC or pay for the new version of the operating system.

Two things have ruined that simple dynamic, and both of them are Apple’s fault. First, Apple started producing major updates to Mac OS X on an annual cycle, and it made the upgrade to the new version available for only $30. Meanwhile, Microsoft was still trying to convince users to pay $100 or more — offering a confusing array of options and licensing models — to do essentially the same thing with Windows. Predictably, Apple has a much higher success rate of moving users to the most current version of the OS, while Microsoft is still begging people to abandon Windows XP.

The second factor is the mobile revolution. Again, most people get a new mobile OS by acquiring a new mobile device. But, when a new version of the mobile OS is made available, it’s simply pushed out as an available update for all applicable devices. Because of interference from device manufacturers and wireless providers, it can still take months — or even years — for some Android devices to get the “latest” OS, but when Apple launches a new version of iOS, it’s very quickly embraced. As of January 2014, four out of five eligible devices have made the switch to iOS 7 in a matter of just a few months.

Then, Apple dropped a bomb with the latest release of its desktop OS. It announced that Mac OS X 10.9– a.k.a. “Mavericks” — would also be available for free.

Microsoft offered a limited-time bargain for Windows 8 that users should have taken advantage of, but even that was still $40. Windows 8.1 was offered for free, but that’s an incremental update akin to Windows 8 Service Pack 1. The real test will be Windows 9.

Cost is not the only factor. In fact, users sticking with Windows XP noted other important factors, including “It works, so there’s no need to change” and “Crucial software depends on Windows XP.” Even if Microsoft gave away Windows 7 or Windows 8, it seems that roughly 80% of users surveyed would continue to use Windows XP.

Moving forward, though, the combination of ubiquitous mobile devices receiving free OS upgrades and Apple setting the precedent of free OS upgrades at the desktop level mean that Microsoft will essentially be obligated to follow that lead and make Windows 9 and subsequent operating systems free.

Granted, that means Microsoft would be giving up a major source of revenue. But giving the OS away for free will help Microsoft maintain its dominance of desktop OS market share and boost the Microsoft brand. Microsoft will just have to capitalize on that OS dominance to make up the difference in revenue from other products and services.

Do you think free software will help Microsoft maintain its dominance on the desktop? Share your thoughts in the discussion thread below.

Why Spamhaus?

Most people have no idea what the Spamhaus Project is. This group of security researchers and IT pros work in the background, alongside many Internet providers and network administrators, in an effort to cut down on email spam. According to its mission statements, Spamhaus was founded in 1998 as a nonprofit organization dedicated to fighting spam. It is run by volunteers and works alongside law enforcement agencies like the FBI, email providers, and networks around the world. In reality, the way they fight spam is by maintaining large blacklists. These are lists of source addresses such as mail servers and websites, where they believe spam is coming from. These blacklists use DNS to block access from these sources, and are updated in real time. Because so many networks and providers use those blacklists, over 1.4 billion people are affected by them. This means that if an IP address is added to a Spamhaus blacklist, a large percentage of the Internet users will instantly be unable to receive anything from that source address. Needless to say, this has huge consequences.

Spamhaus is loved by many, since they have succeeded in bringing down the levels of spam that travel through the Internet. However, it also has a lot of enemies, and is the center of many controversies. The reason is that they have final say on which sites appear in their database. If they decide one particular business is sending spam, and they add their server to the blacklist, that will greatly affect the company’s ability to do business. The site does offer ways to get a case reviewed and potentially get removed from the list, but many still feel that Spamhaus is acting as judge, jury and executioner. So as a result, Spamhaus is often the victim of attacks.

How the attack happened

Spamhaus already has a strong infrastructure that allows them to deal with normal attacks, but on March 18th they started to see a very large attack that they could not handle. So they contacted CloudFlare, a content delivery network that specializes in these types of attacks – since then, CloudFlare has published an account of events. Basically, they used their worldwide Anycast network to spread the DDoS attack over a large number of data centers. Even though the total bandwidth from the attack reached close to 300 Gbps, which is massive and would bring down any normal network, they still managed to cope because of their redundancies. However, the attackers did not stop there.

Seeing that they could not bring down Spamhaus or CloudFlare, they decided to attack their providers, and then the nodes upstream. However, because CloudFlare is so big, those upstream nodes are actual Tier 1 Internet backbones, so in essence the attackers ended up flooding crucial Internet exchange points such as the London Internet Exchange, Amsterdam Internet Exchange, and Hong Kong Internet Exchange. These are the core exchange points of the Internet where all of the large networks peer with each other, and while those have enough bandwidth to cope with such an attack, if all of the traffic comes in through a single port, it can easily slow down access for customers, in this case millions of people.

Controversy about the impacts felt

After the attack and CloudFlare’s post, Gizmodo posted a fairly controversial post titled “That Internet War Apocalypse Is a Lie.” Basically, they claimed that CloudFlare was greatly exaggerating their claims that this attack was seriously impacting the Internet backbone. They say the account of events was overly dramatic, perhaps made to sell CloudFlare’s DDoS protection services. They say that Internet charts do not show services being slow on that day, and talk about how Internet backbones can support Tbps of bandwidth, an order of magnitude higher than what was felt. Since then there have been backs and forths, with CloudFlare countering saying that because some Internet exchange IPs can be publicly known, such an attack could actually disrupt crucial switches, and so on.

The problem of open resolvers

Regardless of whether part of the Internet was disrupted, or this was just affecting a couple of companies, the fact remains that a 300 Gbps attack is really big, much bigger than what most companies can cope with. The reason that bad guys can create such massive attacks is because of a specific flaw in how many DNS servers are configured. By default, DNS can make use of something called a resolver, which will reply with information about a particular address, domain name or site name, and send that information back. Unfortunately, the Internet is filled with open resolvers, DNS servers that will return this information to anyone who asks. Add to that the fact that spoofing an IP address is trivial, and you have a massive issue.

The way the attack goes is that the attacker spoofs his or her originating IP to be the website they want to hit. Then, they ask many of these open resolvers for a lot of information. These servers will then return the information, but not to the attacker, instead to the site being attacked. In essence, you end up directing between ten times to a hundred times as much data as you are sending out. So to create a 300 Gbps attack you would only need 3 Gbps of bandwidth. The DNS servers across the Internet would do the rest, and your real IP would never be seen by the target, which is another plus for the bad guys. The Open Resolver Project is attempting to bring light to this issue, and tracked over 27 million open resolvers across the Internet. The only real fix is for the administrators of all these servers to correctly secure them. There are tips and recommendations on the project’s website to help secure those servers.

Who did this

It is still unknown who is behind the SpamHaus attack, however the hosting provider Cyberpunker is suspected of having sponsored the attack after it was added to the blacklist. As for who did the actual flooding, the New York Times posted about a potential suspect, Sven Olaf Kamphuis from Denmark, who has recently talked about his wish to bring SpamHaus down and describes himself as an Internet freedom fighter. He is described as the prince of spam, someone who hates authority, and former partners of his said he does not care about collateral damage at all. Since then, he has appeared on TV claiming that he is not behind the attack.

Bottom line

The authorities are now investigating the Spamhaus attack, but regardless of whether they manage to find the guilty party or not, there is no doubt that future attacks of this scale – or even bigger — will keep happening. The only true solution is for all of those DNS resolvers to be fixed, but in the meantime, redundant Internet connections, DDoS protection services, and content delivery networks are just some of the elements that can help a network cope with such an attack.

Even the spectre of security breaches and crashing apps is failing to convince some Windows XP-using organisations to abandon the OS before Microsoft cuts off support in a year’s time.

Recent figures, suggest one in five companies using XP plans to stick with it despite the  April 8,2014 deadline, after which no new patches or bug fixes will be issued.

Those organizations may be taking a calculated risk and assume Windows XP’s longevity means major vulnerabilities have been identified and dealt with, but that assumption is misplaced.  It’s certainty that significant new vulnerabilities with XP will be uncovered in the future, if anyone wants to devote their time to it.

You’d be a fool to say every possible vulnerability has already been discovered and either mitigated or patched.  I agree that the amount of scrutiny and field-testing to which XP, first released to manufacturers in August 2001, has been subjected play in its favor. It should theoretically get progressively more difficult to uncover bugs in a system as widespread as XP. All that field-testing, all that field QA, are going to be far more extensive than anything you could have hoped to achieve in a QA lab pre-release. By the same token, because it represents a large target means it will be of continual interest to attackers and security researchers. With the sprawling amount of code that is Windows XP and its legacy nature – it’s not by any token a next-gen operating system – there is a lot of space for vulnerabilities or defects in the code still to exist.

Application-level vulnerabilities

Even if XP were secure, there might be application-level vulnerabilities.  It’s not just the operating system that’s going to be out of support. Almost every application running on it will also no longer be patched because it won’t be economically worthwhile for the application vendor.  When Microsoft drops support, so will the application vendors – if they haven’t already. If XP is no longer supported by Microsoft I’d be surprised – I’m not saying it’s not possible – to see many vendors offering updates. Do we see updates for Flash, or even most Anti-Virus software for Windows 95?, Nope !

In the age of targeted attacks, one of things attackers assess when doing reconnaissance are the operating systems and applications in use.  If you’re using something like Windows XP, it’s absolute gold to an attacker because they’ll know that any vulnerabilities that have been announced after a certain date.

What can be done with continued XP use

However, those planning to carry on using XP after the deadline can take certain steps to limit exposure to risk. I think it’s important to say there are things you can do if, as an organization, you need to continue using XP – whether it’s for cost or compatibility reasons with certain applications or even with certain hardware, there are some technologies you could deploy that will allow you to continue using legacy systems, because that is what XP is going to become, like NT has or Windows 2000 even. Probably one the most important of those is host-based intrusion prevention technology because that is effectively going to allow you to apply a virtual patch to those non-supported environments, It will be able to recognize that a vulnerability exists and make that vulnerability difficult or impossible to exploit even in the absence of a patch. So if you are going to carry on using XP, you will have to investigate mitigating technologies like host-based intrusion prevention.