IT automation (ITA) and business process automation (BPA) have been around for decades, enabling businesses to improve their efficiency and productivity. But with the recent transition from ITA/BPA to robotic process automation (RPA) with the implementation of artificial intelligence and machine learning to keep human efforts and errors to a minimum comes a drawback ie, risks in the form of cyber-attacks!
So, how to do we prevent these attacks and secure confidential information (inventory lists, credit card numbers, addresses, financial information, passwords, etc.) of your employees, customers, and vendors?
The first thing is to set up all the steps right and to think about the risk and controls upfront. Sharpening your focus and asking the right questions is essential to stop risks and get the most out of your RPA. An organization must consider the technical, process, and human elements of the entire robotic ecosystem in securing RPA implementation. A secure design should cover the whole product lifecycle from requirements, selection, architecture, application, and ongoing operations.
How can I secure my RPA ecosystem?
Governance
- Build strategy and security requirements for RPA within policies and monitor compliance with security policies related to RPA
- Establish a governance framework with roles and responsibilities for securing robotics
- Manage RPA risks identified through a formal risk management program and increase awareness among bot creators and business users around the dangers of RPA
Software and product security
- Conduct secure design review, including data flow analysis to verify that controls around security are integrated into the bot authentication, authorization, and input validation
- Ensure schema for bot deployment has security considerations in place
- Perform security architecture risk analysis of chosen RPA solutions, including bot creation, control, and running. Identify security architecture flaws in underlying product for connections across various environments, usage of virtualization methodologies, and authorization flaws
- Integrate security scanning tools as part of the bot creation process to scan code created in the back end for security vulnerabilities
- Scan bot created for security vulnerabilities using dynamic testing or security fuzzing technology to determine security flaws
Digital identity and access
- Manage user access privileges/segregation of duties risk; for example, use of a specialized security matrix authorizes bots only to perform the tasks assigned to them
- Improve auditability (every step could be logged) and control over error-prone manual activities that elevate risk and noncompliance
- Enforce passwords consistently across robotic sessions and centralize robotic identity and access management process; leverage encrypted credential managers to prevent leakage of credentials
- Implement security controls to protect credentials during robotic session run-time; for example, use of single sign-on (SSO) with lightweight directory access protocol (LDAP) supports secured logon to RPA interface
Data identification and protection
- Monitoring of sensitive data processed to verify compliance with usage policies
- Conduct compliance assessment to data regulations for the use of robotics and automation
- Integrity code assessment and validation
Security operations
- Conducting vulnerability scanning of your robotics platform and execute threat modeling exercises to determine technical weaknesses or process gaps.
- Gathering log data from controller and bot runners in order to provide an audit trail of activities such as monitoring for abnormal spikes inactivity, system access and use of privileged accounts.
