As Bots and Robotic Processes Rise in the Enterprise, so Do Security Risks

As business-technology systems grow more complex, so does the need to automate essential management and security processes. With hybrid cloud architectures, DevOps management approaches, and continuous software delivery pipelines, organizations need to automate as many processes as they can automate. For those tasks that require little or no deviation, many enterprises are turning to Robotic Process Automation (RPA).

Through automated actions, RPA provides for effective IT and business process automation. Like cloud, bots use can cost effectively scale up and down as they’re needed. Essentially, RPA is automated business logic that automates some business or IT process. The bot or robot, will take information and transfer data, conduct a transaction or spin up new systems as certain conditions are met, and spin them down when they’re no longer needed.

According to Grand View Research, while the global RPA market size reached a modest $199 million in 2016, it is currently projected to grow at an annual rate of 60 percent. RPA improves businesses effectiveness, Grand View wrote in its report summary.  “By adapting and interpreting existing application for processing a transaction, triggering responses, manipulating data and communicating with other digital systems. Moreover, its [RPA’s] ability to self-learn and self-correct without human assistance reap to the maximum benefit of RPA implementation. RPA technologies can eliminate the high costs requirements by automating the processes that were done manually.”

“The modern enterprise demand RPA technology to be fast in implementation, execution, and scaling. It alleviates human workers of their mundane and repetitive daily tasks by processing workflow much quicker and subsequently more efficiently,” the firm said.

But as these bots grow, so could security related risks. One of the most important steps to take is cataloguing and tracking the capabilities of the bots. What information or processes are they managing, and what is the business value of the information and processes. The more valuable the data and processes the closer the bots must be monitored.

Second, closely manage their access credentials. Have sets of credentials designed for bots that can be provisioned, deprovisioned, and privileges changed as needed. Just as with people, when the role of a bot changes so should its privileges, and when its retired so should all of its access rights. We have been fighting for years to do this with staff and other users, but it’s going to be (and already is at some enterprises) just as important to do this with bots. The key here will be to integrate bot access management within an existing identity management program.

What may prove tricky for some organizations is ensuring that users accessing bots don’t create an escalation of privileges situation, where the bot or the user are accessing information or data that they don’t or shouldn’t have access rights to. This could be managed with the principle of least access. 

And as bot use grows, so will the need to monitor their actions. Bot audit logs are just as important as staff, server, network, and application logs. Both for security and for mitigating situations when something goes wrong.  After all, the bots are coming, and you better be ready.