Written by Naved Rashid, Analyst (Research & Advisory) RPA at Gartner

Robotic process automation (RPA) is a new favorite among IT leaders. It can be quickly deployed to automate repetitive tasks, and it saves organizations time and money. 
That said, RPA is risky. RPA bots handle sensitive data, moving it across systems from one process to another. If the data is not secured, it can be exposed and can cost organizations millions of dollars. 

There are two main risks associated with RPA — data leakage and fraud. Without proper security measures in place, the sensitive data, such as RPA bot credentials or customer data that RPA handles, can be exposed to attackers. Proper governance and security frameworks are essential to mitigating these risks.

To address security failures in RPA projects, security and risk management leaders need to follow a four-step action plan.

1. Ensure accountability for bot actions
   During the COVID-19 pandemic, as organizations rushed to deploy RPA projects to minimize costs by automating menial tasks, one of the most common mistakes they made was not differentiating between bot operators and bot identities. Ensure dedicated identification credentials and identity naming standards by assigning a unique identity to each RPA bot and process. Additionally, can implement two-factor human-to-system authentication along with the username and password authentication. 
2. Avoid abuse and fraud from breaks in security on demand
   RPA implementation can lead to an increase in account privileges, therefore increasing the risk of fraud. Security leaders need to restrict RPA access to what each bot strictly needs to conduct the assigned task. For example, an RPA script with a bot that copies certain values from a database and pastes them into an email should only have read access to the database, rather than write access. Employ session management capabilities such as screenshots or video surveillance to dissuade fraudsters and conduct forensic investigations.
3. Protect log integrity
   In a case where RPA security fails, the security team will need to review logs. Enterprises typically feed RPA logging to a separate system where the logs are stored securely and are forensically sound. Security and risk management leaders need to ensure that the RPA tool provides a complete, system-generated log without any gaps that may impact investigation. 
4. Enable secure RPA development
   RPA development is an ongoing process. It cannot be a one-time activity and needs to evolve to tackle the vulnerabilities and threats. To speed up deployment, enterprises tend to postpone security considerations until RPA scripts are ready to run.

Establish proactive dialogues and regular cadences between the security team and the line-of-business team that leads the RPA initiative. This includes creating a risk framework that evaluates RPA implementation, as well as the individual scripts. Periodically review and test RPA scripts with a special focus on business logic vulnerabilities.