Computer systems left alone unmaintained are a premier source of risks. Those systems may cause a serious crisis and a major service disruption.
On September 14, 2008, All Nippon Airways (ANA), a major Japanese airline, caused the disruption of the ticketing service due to the cryptographic function software expiration (as they announced in the Japanese press release), which is logically assumable about the PKI certificate, according to the other Japanese-written press reports like ITmedia's and Nikkei ITpro's.
The chilling fact revealed was that the ANA left the cryptographic function unused for 2 years and did not make a review about expiration at all when they activated the function for the terminals used by the ticketing agents. This is an awful example of software development indeed.
I wrote about the service disruption for RISKS-DIGEST 25.34 just after the incident occurred. And recently I knew the article was quoted by another blog article yesterday.
The expiration issue is not only about the PKI certificate; domain name registration is another source of expiration risks. An expired domain can be abused for phishing and overtaken by attackers. Software license is another good example. In general, Expiration is a part of overall misconfiguration. So when did you review the expiration date of the system resources under your control last time?
