{"id":7201,"date":"2021-02-18T12:52:50","date_gmt":"2021-02-18T12:52:50","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=7201"},"modified":"2021-03-09T13:59:56","modified_gmt":"2021-03-09T13:59:56","slug":"rpa-security-best-practices","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/rpa-security-best-practices\/","title":{"rendered":"RPA Security Best Practices: Balancing Digital Transformation While Managing RPA Security Risks"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7201\" class=\"elementor elementor-7201\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Are you considering implementing RPA (robotic process automation or bots) as part of your digital transformation? <\/span>RPA security best practices will help you utilise this growing trend safely and for maximum benefit. RPA usage <a href=\"https:\/\/www.gartner.com\/en\/newsroom\/press-releases\/2019-06-24-gartner-says-worldwide-robotic-process-automation-sof\" target=\"_blank\" rel=\"noopener\">grew by 63.1%<\/a> to $1.3bn in 2019, and is expected to reach $7.2bn by 2025, making it the fastest growing segment of the global enterprise software market, and it is easy to see why. RPA revolutionises workflows, saves money, improves services, and crucially removes an element of human error from both workflows and information security.<\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">However, RPA like any other form of technology that is introduced to an organisation\u2019s network, also introduces new security risks, which if not considered, could have a negative impact on an organisation\u2019s overall security posture. To get the best out of robotic process automation, it is important to implement RPA security best practices.<\/span><\/p><h2><span style=\"font-weight: 400;\">Understanding the bot security risk<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Simply put, RPA introduces a <\/span><a href=\"https:\/\/www.darkreading.com\/edge\/theedge\/rise-of-the-robots-how-you-should-secure-rpa\/b\/d-id\/1338451\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">new vector for cyber attacks<\/span><\/a><span style=\"font-weight: 400;\"> to your network. RPA utilises technology to carry out tasks, and like any program within a network they present an additional attack vector, especially if they are poorly designed, neglecting key information security principles. If RPA technology is exploited, an attacker could carry out malicious activity on a large scale, causing significant damage.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">If an RPA solution is designed poorly, it may be able to breach security controls by utilising high privilege user permissions, revealing sensitive information to untrusted parties and potentially releasing sensitive data outside the organisation.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In order to perform set tasks, RPA is granted access to multiple systems, many of which contain sensitive organisational or personal information. If attackers are able to compromise the bot\u2019s RPA privileged access they may access both the information the bot can access, and potentially use it as a back door to other parts of the network.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Many RPA solutions are described as plug and play integrations, meaning that they do not necessarily require input from an IT professional in order to set up and operate them. While this is useful for a small business who don\u2019t have dedicated IT resources, it is not ideal from a security perspective. RPA like any new technology should be checked over before it is added to a network to avoid unintentionally exposing the network to a malicious device.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">RPA bots are designed to carry out tasks quickly and efficiently, but if poorly configured, they could overwhelm the network, making it operate slowly, disrupting services, and leading to a denial of service. This denial of service could cause some security controls to be inactive, enabling security breaches.<\/span><\/p><h2><span style=\"font-weight: 400;\">RPA security best practices<\/span><\/h2><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Implementing <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">RPA security best practices<\/span><\/a><span style=\"font-weight: 400;\"> enables an organisation to reduce the security risks of bots operating in the network. The key to managing security risks in RPA is to treat the RPA in the same way as you would treat any other system or even employee in the organisation.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Some RPA security best practices are summarised below.<\/span><\/p><p style=\"font-weight: 400;\"><b>Choose your RPA carefully<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Not all RPA developers are created equal. When it comes to choosing a new RPA technology, information security needs to be considered alongside functionality requirements. A poorly coded bot could contain malicious code or security vulnerabilities. Where possible, ask for security assurances from RPA suppliers, carry out code reviews or penetration testing before connecting an RPA solution to the network.<\/span><\/p><p style=\"font-weight: 400;\"><b>Create a security governance framework for RPA<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">It is important to manage the security risks of RPA through a set of dedicated controls. An RPA governance framework shall include regular risk assessments and audits of RPA processing activities. Employees overseeing the RPA shall have clear security responsibilities, including controlling the access to the RPA environment, logging and monitoring its activities and more. A security requirement checklist shall be maintained for the RPA technologies in place, and there should be defined responsibilities to carry out regular assessments of the RPA\u2019s information security compliance.<\/span><\/p><p style=\"font-weight: 400;\"><b>Implement password management controls for RPA systems<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Bots use passwords to access multiple systems. These passwords are set and maintained by network administrators, and they may need to be accessed by several employees overseeing the RPA. RPA security best practices recommend storing RPA credentials in a centralised, encrypted location that can only be accessed by a limited number of employees (for example in a password vault).<\/span><\/p><p style=\"font-weight: 400;\"><b>Reinforce data and network security around the RPA<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The RPA bot accesses the network in order to carry out tasks. Managing the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">security risks<\/span><\/a><span style=\"font-weight: 400;\"> in RPA access to the network requires proper management, including:<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8211; Limiting bot access to the network resources by applying the principle of least privilege, giving them access to only the systems needed for defined tasks<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8211; Maintaining proper segregation of processing machines, based on the tasks the bot is carrying out<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8211; Ensuring that security updates are applied to patch vulnerabilities<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8211; Checking the functional specification documents before the bot is connected to the network<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">&#8211; Assigning unique IDs to each bot, and maintaining a repository of bots, IDs, access permissions and more to enable monitoring<\/span><\/p><p style=\"font-weight: 400;\"><b>Define roles and responsibilities for the RPA and overseeing humans<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">In the same way as every employee has a defined role and access to systems based on that role, so should every RPA in the organisation. Access privileges should be defined based on the bot\u2019s tasks, and access to data should be segregated based on the bot\u2019s role. Bots should not get admin permissions or elevated access to systems unless it is strictly necessary.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">On the human side, a dedicated bot administrator should oversee the RPA workflow, and manage bot schedules, monitor progress, carry out security checks, audits, and updates. There shall be a robust change management process, which defines who is responsible for changes, assessing risk, reviewing performance, approving new tasks or changes, and controlling backups.<\/span><\/p><p style=\"font-weight: 400;\"><b>Maintain accurate logs<\/b><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Managing security risks in RPA requires knowing what the bot is doing. Each bot connected to the network shall have complete audit logs to track activity, and to help understand the causes in the case of an incident.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The logs shall also be analysed regularly to monitor for abnormal activities, unusual system behaviour, or abuses of privileged accounts. The logs should also be audited independently to confirm that the RPA is performing as expected.<\/span><\/p><p style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Are you considering implementing RPA (robotic process automation or bots) as part of your digital transformation? RPA security best practices will help you utilise this growing trend safely and for maximum benefit. RPA usage grew by 63.1% to $1.3bn in 2019, and is expected to reach $7.2bn by 2025, making it the fastest growing segment&hellip;<\/p>\n","protected":false},"author":10,"featured_media":7205,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7201"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=7201"}],"version-history":[{"count":0,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/7201\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/7205"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=7201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=7201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=7201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}