Robotics process automation and Identity &Access management

In this article, we will talk about BOT, RPAs, and the management of bot accounts through traditional IAM standards.

Need for improvement in identity and access management process to include bot identities as an important part of the strategy to manage risk, increase audibility and visibility.

Right IAM for RPA AND Right RPA for IAM

Does that sound too confusing? Let’s understand what it means:

Current identity and access management tools, technologies, and processes focus on managing users and resources but not for bot identities which requires accountability of the process owner utilizing a software robot as well as permission of the data owner. Lack of process, standards and patterns for access rights of RPA leads to a lack of audibility and visibility.

Right IAM for RPA

Robotic process automation helps you automate transactional, rule-based tasks by simulating user interactions. RPA can reduce risks and save workers time by automating time-consuming, tedious, and error-prone tasks for example following tasks can be automated to reduce effort and efficiency using RPA.

• Automated reports generation and communication
• Email alert management
• Financial account reconciliation
• Payroll processing
• Inventory record keeping
• Virtual assistants or ‘chat bots’
• Data lifecycle management (Regular ETL)
• Vulnerability analysis

However, RPA Bots use digital identities to authenticate against various systems/databases to be able to perform these tasks which grows our risk surface from Human accounts to non-worker accounts/NPEs and make them target for attacks.

Right RPA for IAM

Obviously thought leaders in the identity and access management space have already started to design and talk about the use of RPA for identity and access management tasks.

So, the RPA and IAM are complementing each other. However, if done wrong, the use of RPA can cause severe security challenges. We do have a well-defined identity lifecycle and process, IDM setups to manage our digital identities for Employees, Vendors, Contractors but usually lacks the right infrastructure to manage bot identities.

To be continued..