Regular Security Updates to End for SQL Server 2008 and SQL Server 2008 R2

Microsoft is ending support for SQL Server 2008 and SQL Server 2008 R2 in July 2019. If you are still using this database software, here are your options.

After more than a decade of service, SQL Server 2008 is being retired. Microsoft is ending support for this software on July 9, 2019. This day also marks the end for SQL Server 2008 Release 2 (R2). Contrary to what its name suggests, SQL Server 2008 R2 was released in 2010.

While SQL Server 2008 and 2008 R2 will still work, using them to drive the backend of your business can be risky. That’s because Microsoft will no longer be issuing regular security updates for them, leaving your database systems defenseless against new strains and new types of malware. Not being able to protect your systems against new threats will make it harder to achieve compliance with regulations such as the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA). Noncompliance can result in penalties, higher costs, and even lost business.

If your business is still running SQL Server 2008 or 2008 R2, it is important to keep these risks in mind when contemplating what to do. Assuming that you do not want to switch to a different vendor’s database system, here are your choices:

On-Premises Options

If you want to keep your SQL Server databases on-premises, you have several options:

• Do nothing. You can keep using SQL Server 2008 or 2008 R2 without any updates, despite the risks. This course of action is not recommended.
• You can upgrade your database software. At the time of this writing, SQL Server 2017 is the most recent version, but SQL Server 2019 is already at the preview stage. Either would be a good choice. Alternatively, you could upgrade to SQL Server 2016 if it is a better fit for your database environment.
• Purchase Extended Security Updates. Realizing that companies might need more time to upgrade their on-premises database systems, Microsoft is offering Extended Security Updates. These updates will address security issues that are deemed critical by the Microsoft Security Response You can purchase Extended Security Updates annually for up to three years. To be eligible, your server needs to have a SQL Server license with an active Software Assurance subscription.

Choices in the Cloud

If you are comfortable with using cloud services, you might consider moving some or all of your database operations to Microsoft Azure, a public cloud computing platform. To entice SQL Server 2008 and 2008 R2 users into its cloud, Microsoft is promoting two options:

• Rehost database operations in a managed instance. You can permanently migrate your SQL Server 2008 or 2008 R2 operations to an Azure SQL Database managed instance. Because this is a Platform-as-a-Service (PaaS) solution, you won’t have to worry about updates or upgrades in the future. Microsoft is responsible for taking care of these types of management tasks.
• Move database operations to virtual machines. You can temporarily move your SQL Server 2008 or 2008 R2 operations to Azure virtual machines until you are ready to upgrade to a more recent version of SQL Server. With this Infrastructure-as-a-Service (IaaS) solution, you get three years of Extended Security Updates at no additional charge.

If you have a SQL Server 2008 or 2008 R2 license with an active Software Assurance subscription, you can take advantage of the Azure Hybrid Benefit for SQL Server program. It lets you leverage your existing license to receive discounted pricing when you are migrating your SQL Server workloads to either an Azure SQL Database managed instance or Azure virtual machine. Because you get to use your existing licenses, Microsoft is touting this as its most cost-effective solution.

An Important Decision

Cybercriminals like to target databases. Once there are no longer any regular security updates for SQL Server 2008 and 2008 R2, databases running this software will become particularly enticing to them. For this reason, it is best to take action before July 9, 2019. Determining what action to take, though, can be difficult because there are several options from which to choose.

You do not have to make the decision alone. We can help you weigh the advantages and disadvantages of each course of action.

Installing 45 Security Updates flickr photo by brianwc shared under a Creative Commons (BY-SA) license