Pandemic-driven shifts to distributed work models, large-scale investments in SaaS and cloud services and strong focus on digital transformation has brought a surge in new identities in the enterprise. According to IDSA research, 83% of organizations experienced an increase in identities since last year, with one in five reporting the number of identities they manage increased by more than 25%.
While the term “identity” may imply a human connection, many of these new identities belong to non-human entities such as devices, applications, cloud services, virtual machines, containers, and increasingly, Robotic Process Automation (RPA) bots. Digital transformation and automation projects often mean hundreds, and sometimes thousands, of machine identities — or “power users” with unrestricted, anytime privileged access to critical systems and applications.
Securing these powerful machine identities is a critical part of an identity-centric security strategy, particularly when it comes to RPA, one of the fastest-growing enterprise software categories today. In this post, we’ll examine the rise of RPA, the important role machine identities play in enabling this transformative technology and how to #BeIdentitySmart in protecting them.
RPA: Next Technological Disruption in the Enterprise
RPA is poised to be the next disruptive technology, but helping businesses and their employees achieve the efficiency, accuracy and speed needed to compete and thrive. By utilizing pragmatic AI to drive process automation and digitization, RPA can automate a wide range of knowledge work carried out in today’s digital environment with great speed and precision — while allowing humans to focus on higher-value (and often more rewarding) work. RPA systems range widely in scale and complexity, from simple website chat bots that can answer standard queries to deployments of thousands of bots that can automate credit card processing and fraud detection jobs.
Rethinking How We Work with RPA
Though digital transformation has been on the corporate agenda for some time, some organizations are struggling to make the most of their digital initiatives. RPA is helping many companies overcome these challenges, not only by automating manual processes and enabling users, but also by helping teams break through conventional thinking. For example, in the financial services industry, RPA bots are helping to do everything from streamlining manual underwriting processes, reducing fraudulent activity through account monitoring and assisting with new customer onboarding. By adopting RPA technology — even if it’s one small-scale project to start — organizations can quickly begin to see how they can apply automation to other areas of the business to their advantage.
When considering how RPA may work best for your organization, first examine the work your team is doing to determine which tasks require human involvement — and which repetitive, manual tasks could be offloaded to robots, such as data entry, transaction processing, response triggering and communicating with other digital systems. It’s important to remember that RPA technologies are meant to enhance, not replace, the human workforce. By shifting time and energy away from such low-value, high-volume tasks, employees can focus on ideas, innovation and the best parts of the job that brought them to your organization in the first place.
There are two main types of RPA bots: attended bots that work under human supervision, helping workers do their jobs, and unattended bots that can run without human involvement.
Your organization’s evaluation of RPA needs should involve both a top-down approach (to identify and prioritize key areas for automation to maximize ROI) and a bottom-up approach (to empower workers with automation based on their individual needs).
Protecting RPA Initiatives with Identity Security
As with all digital transformation projects, security must be a key consideration from the start of an RPA initiative.
RPA bots and automation processes often require high levels of privilege to do their jobs, from interacting directly with business applications to mimicking human behavior and mirroring human identity and access permissions across multiple systems. This provides attackers with yet another potential way to steal data and cause chaos — particularly the estimated one-third of all RPA deployments running unattended today. For example, if threat actors can get their hands on unsecured RPA admin and bot credentials, they could gain access to critical business systems and data.
As RPA adoption expands, the key to efficient scaling and securing of growing robot access to business systems is building in Identity Security from the beginning. By enforcing consistent, traceable policies such as automatically rotating privileged credentials, establishing secure connections and placing time limits on access permissions — along with driving automation security awareness across the enterprise — organizations can mitigate the risk of credential-based attacks.
As their titles suggest, automation engineers are focused on streamlining or eliminating as many manual processes as possible — and security is no exception. Perhaps the greatest benefit of an identity-centric approach to RPA security is that critical security tasks, such as credential management, can be automated to remove former roadblocks that could slow things down, achieve new levels of operational efficiency and safely scale RPA initiatives faster.
By approaching RPA projects and Identity Security hand in hand, your organization can more effectively secure non-human identities and deliver enhanced digital experiences safely and quickly to customers.
This #BeIdentitySmart Week, consider starting a conversation about the importance of identity in digital transformation initiatives such as RPA with your line-of-business leaders, operations teams or C-suite. To help focus these important stakeholder discussions on business opportunity and impact, tap into these prescriptive recommendations from IT security executives at Global 1000 enterprises.
About the Author: Justyna Kucharczak is a Sr. Product Marketing Manager with CyberArk responsible for evangelizing the company’s Identity Security platform.
