Running Unsupported VMware with No Access to Security Patches
Severity Level: Priority 1
Category: Infrastructure / Compliance
Description:
The bank operates VMware vSphere 7, which is not end-of-life until April 2, 2027, for general support. However, following Broadcom's acquisition, security patches and updates are restricted to customers with active paid support contracts, costing approximately $5,000 per server. The bank's lack of a valid support contract results in no access to critical security patches, leading to significant examiner concerns and risking audit scores of 3 or 4.
Impact:
- Increased security risks from unpatched vulnerabilities due to lack of access to security patches.
- Regulatory penalties and poor audit scores due to non-compliance with supported software requirements.
- Financial burden from potential fines or forced licensing costs.
FFIEC Reference:
- FFIEC IT Examination Handbook (November 2016):
- "Software must be licensed and supported to ensure compliance and security." (p. 40)
- "Unsupported software increases regulatory and operational risks." (p. 42)
Recommendations:
- Initiate Hyper-V Migration: Begin immediate transition to Hyper-V to eliminate licensing and support issues.
Plan Budget: Allocate resources for Hyper-V implementation.