A recent industry report shows that 44% of Android users are still using versions 2.3.3 through 2.3.7 (also known as Gingerbread). Gingerbread was released in 2011 and is now subject to a number of security vulnerabilities.
Keeping your device up to date is the best practice for a secure phone. Unfortunately, some devices may not receive updates at all because of mobile carriers phasing out older models. So you may have to upgrade your device before you can update your Android OS. Here are some instructions on how to check your Android version.