As Microsoft launches Vista, many news organizations are speculating about how quickly (or slowly) companies will migrate to Vista. Back in the real world, however, there is no shortage of decades-old legacy systems that companies are either reluctant or unable to migrate to newer platforms and operating systems.

If you’re involved in security audits you will be well aware of all the hidden “gems” lurking in long-forgotten corners of your data center. Systems running Windows 2000, NT or even 3.0 are found in many organizations. Many of these systems run highly critical applications, as recounted in oft-repeated anecdotes of the “forgotten server in the closet running all of purchasing.”

For data center managers, these legacy systems represent enormous challenges for security, maintenance, disaster recovery and availability. To add to these woes, a little-noticed law, “The Energy Policy Act of 2005,” will soon bring on a repeat of the Y2K scramble as the daylight-savings rules are modified.

Legacy systems present challenges in maintenance for several reasons. Manufacturers will cease supporting systems that have reached end-of-life status, even though there may be millions of their products still in production use. Maintenance and security patches will become scarce and harder to apply as the systems age. Furthermore, the skilled administrators of old mainframes and old software will often retire or switch careers, leaving no one at a company with the skills or documentation to continue supporting a system.

Here are some of the biggest challenges with legacy systems:

* Software maintenance and support (functional upgrades). As systems age, bugs can go unnoticed and appear when no one is left who knows how to fix them. After manufacturers cease supporting a system, it will languish without support for the latest software or protocols.

* Security maintenance (“dysfunctional” upgrades). A huge challenge is related to security. Older systems are still targets for attacks both old and new. Not only is the legacy system able to catch an infection from a long-dormant virus (viruses from the '90s are still infecting systems today), but also new threats can emerge that affect protocol stacks and software vulnerabilities, for which no patch will ever be issued.