Banks Content to Wait to Upgrade to Windows 10

Microsoft began rolling out its latest operating system, Windows 10, on Wednesday. Many banks skipped the last version of Microsoft's still-ubiquitous PC operating system, Windows 8, but are looking to adopt Windows 10 as the uber-program that manages all the software running on their employees' computers.

But they're in no hurry. In interviews with bankers, many said that although they are looking forward to many of the features of the new operating system, they will take time to test before deploying it.

"Banks will need to test existing software, apps, device drivers and printer drivers on Windows 10 before full adoption to make sure they are 100% compatible," noted Philip Smith, CIO of Harvard State Bank in Harvard, Ill.

Inder Koul, CIO of $39 billion-asset First Niagara Bank in Buffalo, N.Y., echoed this sentiment.

"We recently finished a major Windows 7 upgrade and are in no rush to upgrade again immediately," he said. "As you know, there will always be some hardware incompatibility with a new OS release — and that will be part of the due diligence and testing."

The bank plans to test first, and upgrade when appropriate. "Once we certify Windows 10, we will start a proof of concept almost immediately and start a limited internal release on our newest hardware," he said.

Most banks will not migrate this year, predicted Ojas Rege, vice president of strategy at MobileIron, a Microsoft partner that provides mobile security software to banks. "They'll wait to make sure it's stable," he said. More will embrace it next year, he said.

Microsoft will be pushing companies hard to upgrade, however. In this mobile-first world, where new versions of iOS and Android come out every year and 80% of iOS users upgrade immediately, it's hard for an operating system to stay innovative on a three-year upgrade cycle. Microsoft is providing tools to help people migrate easily and for free to the new version.

"I'm expecting to see large-scale migration to Windows 10 starting at the tail end of this year and into 2016 in banking," Rege said.

Pros of Windows 10
There's a lot for bankers to like about Windows 10, especially as compared to Windows 8, which put people off by hiding the Start menu and adding confusing elements to its user interface like tiles and charms.

"Windows 10 has promised greater security, an integrated Start menu, and better flexibility between the use of a keyboard and mouse versus a touch screen," Smith said.

The main perceived benefit of Windows 10 to bank IT executives is improved security.

"The new security features look promising and more business grade," said Koul.

One reason Windows 10 is more secure is it provides a way to separate work and personal data, something no previous version of Windows has done.

"The file system on a laptop is open," said Rege. "That means if you download a personal app, it can access corporate data on the laptop, if you download a work app, it can access my personal data on the laptop. That's why the only way for regulated industries to secure that was to lock it down so you can't do anything personal on it."

But in the newer generation of Windows 10 laptops (as well as in iPhones, iPads and Android devices), the operating system architecture lets every application have its own memory and storage in a technique called sandboxing.

"If I have a personal app on the device, it can store its own files but it can't access files from any other application," Rege said. "If I have a work app on the device, it can access its own files, but not files from any other application."

This will require IT executives to put new security models in place, he said.

"If I were the CIO of a bank, this would be the summer for me to think about how even the basic architecture of Windows is changing, the entire architecture of every end user device I have in my organization will shift over the next 12 months in a good way, they're all going to be more secure," Rege said. "But it does mean some of the security mechanisms I had before and processes and technologies won't be relevant anymore and I'm going to have to make sure I understand the new architecture to put in place the people, processes and tech to make it work."

And there are always concerns about the security of a new operating system — hackers will look for holes to exploit, for instance. Security expert Brian Krebs recently warned that Windows 10 shares users' Wi-Fi passwords with their Outlook contacts.

"We always have security concerns with new releases, and that's why we do testing and create limited internal releases to accomplish our proofs of concept," Koul said. "Security testing is paramount in every new technology and innovation we deploy to our staff and customers."

Smith is concerned about the new approach to patch management Microsoft has launched with Windows 10: instead of offering "Patch Tuesdays" in which all recent software patches are collected and pushed out once a week, Microsoft will push updates out automatically as they become available.

Company systems administrators usually refrain from rolling out patches and updates to company devices until they've tested them.

"We are cautiously looking at Microsoft's new security delivery system for patch management as Microsoft may limit an institution's ability to block or delay of implementation of some patches," Smith said. "Relinquishing control over patch management can lead to a system rebooting when it shouldn't, untested patches being deployed on systems, and the creation of potential conflicts on well-managed and configured systems."

Another anticipated feature is enhanced integration with touch screens, which, it is hoped, more manufacturers will support.

Smith expects this will spur more fintech providers to create more touch-based applications for banks, Smith said. "We will see more and more applications that have used signature pads for account opening and loans move to tablet-based applications, with customer service employees and loan officers using dockable tablets both to gather signatures and as their main computer," he said. Signature pads will still be used in teller lines, he suggested.

And Koul is also hoping for fast start up times and quicker web page and app loading, which he found when testing Windows 8 (which the bank ultimately rejected for not being business-ready). "We are hoping Windows 10 doesn't disappoint there," he said. "This would be important to our teammates."