Number: IN19-002
Date: 12 March 2019
Purpose
The purpose of this Information Note is to draw attention to the end of life for Microsoft SQL Server 2008 and Microsoft SQL Server 2008 R2. Effective 9 July 2019 Microsoft will no longer provide automatic fixes, security updates, or online technical assistance for these products.
Assessment
As of 9 July 2019, Microsoft will no longer support SQL Server 2008. Organizations running this software after the end of support date will no longer receive security updates, and may be exposed to outage, compliance and security risks. Hardware and software compatibility issues may also arise when implementing current technologies which may not have been designed for use with Microsoft SQL Server 2008 or SQL Server 2008 R2.
Migration to newer versions of Microsoft SQL Server can present unique challenges and it is critical that those organizations operating Microsoft SQL Server 2008 and/or SQL Server 2008 R2 plan and test a migration solution before the deadline. Applications may have compatibility issues with more recent versions of SQL Server.
The Canadian Centre for Cyber Security (Cyber Centre) recommends that the planning for the migration of databases include the following:
- Have an accurate inventory of which SQL Databases will need to be migrated.
- Decide whether the databases will be upgraded, migrated or cloud hosted.
- Decide on a destination for these databases.
- Decide on a supported SQL Server version
Organizations will need to identify all infrastructure, application and hardware dependencies when planning SQL Server database migration. The Microsoft Assessment and Planning Toolkit (MAP) can be used to discover Microsoft SQL Server instances within an organization’s network and assess readiness. The Microsoft SQL Server Upgrade Advisor has the ability to perform a detailed analysis of Microsoft SQL Server installations and their respective configurations to identify possible known issues that may affect the upgrade process.
Options are available to purchase Extended Security Updates for up to 3 years for database environments that cannot be migrated by 9 July 9 2019. These updates will only cover security vulnerabilities deemed to be “critical” by Microsoft.
Suggested Action
CCCS strongly encourages Information Technology owners and operators to begin planning their migration to an updated SQL Server database system as soon as possible.
References
- Prepare for SQL Server 2008 End of Support
- Microsoft Assessment and Planning Toolkit
- SQL Server Upgrade Advisor
- FAQ for Extended Security Updates
- Microsoft Product Lifecycle
- Microsoft Support Lifecycle Policy FAQ
Note to readers
The Canadian Centre for Cyber Security (Cyber Centre) operates as part of the Communications Security Establishment. We are Canada's national authority on cyber security and we lead the government's response to cyber security events. As Canada's national computer security incident response team, the Cyber Centre works in close collaboration with government departments, critical infrastructure, Canadian businesses and international partners to prepare for, respond to, mitigate, and recover from cyber events. We do this by providing authoritative advice and support, and coordinating information sharing and incident response. The Cyber Centre is outward-facing, welcoming partnerships that help build a stronger, more resilient cyber space in Canada.