RPA could be risky if not implemented properly. RPA bots handle sensitive data, moving it across systems from one process to another. If the data is not secured, it can be exposed and can cost organizations millions of dollars.
“There are two main risks associated with RPA — data leakage and fraud,” says Naved Rashid, Associate Principal Analyst, Gartner.
“Without proper security measures in place, the sensitive data, such as RPA bot credentials or customer data that RPA handles, can be exposed to attackers. Proper governance and security frameworks are essential to mitigating these risks,” says Rashid.
To address security failures in RPA projects, security and risk management leaders need to follow a four-step action plan.
1. Ensure accountability for bot actions
Ensure dedicated identification credentials and identity naming standards by assigning a unique identity to each RPA bot and process. Additionally, can implement two-factor human-to-system authentication along with the username and password authentication.
2. Avoid abuse and fraud from breaks in security on demand
RPA implementation can lead to an increase in account privileges, therefore increasing the risk of fraud. Security leaders need to restrict RPA access to what each bot strictly needs to conduct the assigned task. For example, an RPA script with a bot that copies certain values from a database and pastes them into an email should only have read access to the database, rather than write access.
3. Protect log integrity
In a case where RPA security fails, the security team will need to review logs. Enterprises typically feed RPA logging to a separate system where the logs are stored securely and are forensically sound. Security and risk management leaders need to ensure that the RPA tool provides a complete, system-generated log without any gaps that may impact investigation.
4. Enable secure RPA development
Establish proactive dialogues and regular cadences between the security team and the line-of-business team that leads the RPA initiative. This includes creating a risk framework that evaluates RPA implementation as a whole, as well as the individual scripts. Periodically review and test RPA scripts with a special focus on business logic vulnerabilities.