What do legacy IT and on-premises mean, and why is legacy IT a particular challenge for security?

Legacy IT means old systems that may no longer meet today's state of the art or were not designed to run in modern environments; on-premises (on-prem) means "in our own data centre", as opposed to a service hosted by an external provider such as a cloud or outsourcing partner.

* On-prem is what runs in our own data centre. A legacy system there gets its security from the zone around it. *

• Legacy IT is hard to secure because it often cannot be patched, changed or integrated with modern security mechanisms. The security usually has to be built around it, for example by isolating it, rather than into it.
• On-premises literally means "on one's own premises". Its counterpart is any service hosted by someone else: a cloud service at a cloud provider, or a server in an outsourcing partner's data centre. The distinction matters for who controls, operates and is responsible for the system.

Go deeper:

• NCSC — Obsolete products — how to live with systems that get no more updates: cut attack routes, isolate them in zones, monitor them.
• Legacy system — Wikipedia — missing patches, lost vendor support and lost expertise.
• On-premises software — Wikipedia — own site versus provider-hosted, and who operates and answers for what.