SK Telecom 2025 breach and an old patch
That finding, recounted in an ASPI report titled Past its use-by-date, illustrates a simple but persistent governance failure: a known fix existed, but the patch never reached an operational system. The report says attackers had reportedly maintained access for years. South Korea — often cited as a leader in digital infrastructure — became "a particularly uncomfortable example" of how responsibility for ageing technology can evaporate between those who understand the technical risk and those who control the funds to act.
PhilHealth 2023 ransomware and lapsed licences
In the Philippines, the report highlights PhilHealth’s major ransomware incident in 2023 after its antivirus licence had expired. The episode shows another pathway into long-lived risk: security protection can lapse simply because an organisation fails to maintain the commercial arrangements that keep it working. Subsequent debates over procurement requirements, the report notes, demonstrated how bureaucratic processes and contract rules can leave systems exposed.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadProtective relay (2012) — firmware limits and post‑quantum concerns
The report uses a concrete equipment example to make an architectural point. A protective relay installed in 2012 and designed to run for 25 years would be expected to remain in service to 2037. Its firmware might rely on a digital key fixed in the device’s chip to check authenticity. If the hardware cannot accept a new method for checking authenticity, no software patch will solve that problem — the device can do its functional job while being impossible to secure to contemporary standards.
That limitation is particularly salient as organisations prepare for the transition to post‑quantum cryptography. Much discussion has focused on which algorithms to adopt and when to begin migration, but those conversations usually assume existing systems can be upgraded. The ASPI report warns some cannot. It also points to another quantum-era risk: adversaries collecting data now in the hope of decrypting it later, and future cryptographic advances undermining the digital checks devices use to confirm software authenticity.
Australia’s critical-infrastructure operators, asset registers and capital planning
The report argues Australia’s critical‑infrastructure sector should concentrate on what can be done now. Most operators already keep asset registers and risk registers, but the useful question is whether those records tell management which critical systems have lost vendor support, which will soon lose it, and which cannot accommodate the security changes they will need during the remainder of their operational lives.
For those systems, the report says someone should be able to explain what replacement involves, how long it will take, and what the organisation is doing in the meantime. That information, it recommends, belongs in capital planning and board reporting. Where replacement is impracticable, the decision to continue operating should be explicit, come with appropriate controls, and include a date for reconsideration.
What this means for technologists, policymakers, and procurement leaders
Technologists and security teams: identify the critical systems that cannot be upgraded, and quantify what replacement would involve. The report sets a tight benchmark — a 90‑day challenge to list unupgradeable critical systems, work out replacement steps, and escalate the decision to someone with authority to act.
Policymakers and regulators: ensure asset and risk reporting capture vendor support status and the ability of long‑lived equipment to accept future security controls, including cryptographic updates. The report frames this as a governance responsibility — the risk too often slips between operational teams and budget holders.
Procurement leaders: buy products with credible accounts of security‑support life and upgrade options. The report warns that purchasing equipment expected to remain in service for decades without a clear security‑support and upgrade roadmap is effectively buying the next generation of legacy problems.
The pattern the report describes is familiar and avoidable: systems left running because replacement is difficult, expensive or disruptive; institutional inertia; and a slow accumulation of hidden costs as spares vanish and specialist knowledge walks out the door. The remedy it prescribes is procedural and practical — identify unfixable systems, cost and schedule their replacement, and make an explicit, board‑level decision when replacement is impracticable. Start that work now, the report says: the time to plan is finite, and the clock on long‑lived equipment is already ticking.
Read the original ASPI piece: Someone must take responsibility for ageing legacy technology
