How can you secure your legacy systems when patches are no longer available?

To secure legacy systems without available patches, start with a risk assessment to identify vulnerabilities. Implement additional security measures like firewalls, IDS, and application whitelisting to protect against threats. Use network segmentation to isolate the legacy system, limiting access to essential users and monitoring for unusual activities. Consider migrating to supported software or using virtualization to run legacy applications securely. Regularly update your security strategy to address new threats and changing business needs, ensuring legacy systems remain secure despite the lack of patches.

Proper isolation should be applied to not only the legacy system but also the whole infrastructure according to zero trust principle.

Legacy systems... is a beautiful way of saying something is obsolete, and must be frowned upon at any given opportunity. If that obsolete system is making revenue for any company, the question would be why is it in operation in that state? Checking the lifecycle management phases with the OEM would indicate that it should have transitioned to a new system long time ago! Be that as it may, virtualization would be the saviour of the day, as the operating system the legacy system runs on, is unrecognisable and even the newer hardware platforms cannot recognise it, but with virtualization (this is inclusive of containerization, dockerization etc), that obsolete system can run, but will have to be heavily guarded,and monitored continuously.

This is the natural thing to do and must be done prior to the system becoming or reaching obsolescence status aka "Legacy". The fact that the system is legacy, rules out any cloud based solutions, because who is going to pay for the services rendered? there is a reason why the system is obsolete, and that reason is definitely monetary or simply negligence. Therefore, cloud is a no-no, unless one wants to initiate a self imposed "DDOS" as a result of non-payment to the CSP. Moral of the story is that, the life-cycle management of the system from commissioning instances must be taken seriously to avoid such unnecessary situations.

For legacy systems, I am afraid that it is too late, that the system must either be upgraded, decommissioned or replaced. For non-legacy systems, yes, patch management becomes important and to help prevent repetition of the legacy systems situation.