Cyber Defense eMagazine December 2019

62
The typical approach in providing privileged access credentials to bots is to hard-code privileged access
credentials into the script or rules-based process a bot follows. With another method, the script might
include a step to retrieve credentials from an insecure location such as an off-the-shelf application
configuration file or database.
As demand for RPA increases among lines of business, the number of privileged account credentials
hard-coded into scripts or stored insecurely grows. That significantly increases the associated risks.
With these approaches, the credentials end up being shared and reused repeatedly. Unlike the
credentials used by humans, which typically must be changed regularly, those used by bots remain
changed and unmanaged.
As a result, they’re at risk from cyber criminals and other bad actors who are able to read or search scripts
to gain access to the hard-coded credentials. They are also at risk from users who have administrator
privileges, who can retrieve credentials stored in insecure locations
As RPA deployments expand to include larger numbers of bots, the risks become exponentially greater
for organizations. If privileged account credentials used within an RPA platform are left unmanaged and
unprotected, that can transform RPA processes into a backdoor through which attackers can gain access
to corporate systems and do damage.
Organizations can take three critical steps to start mitigating the risk of the RPA pipeline becoming
compromised, building security directly into their RPA workflows and processes.
1. Store and manage privileged credentials securely
To keep privileged account credentials from falling into the wrong hands, they can remove credentials
from bot scripts and other insecure locations.
Instead, they can be stored in a system that encrypts the credentials; holds them in a secure location;
hands them securely to authenticated bots on-demand; automatically rotates credentials at regular
intervals or on-demand; removes human intervention from the process; and scales to meet rapid growth
in RPA use.
2. Limit the bots’ application access
If an attacker acquires privileged account credentials, companies can minimize the impact by limiting the
number of applications to which the credentials allow access.
That means granting bots privileged access only to the specific applications they need, preventing other
applications from executing. This prevents bad actors from using multiple applications on a client machine
and gaining the local administrator rights allowing them to install spyware and other malware.
3. Protect administrator credentials or else
Companies should deploy a secure infrastructure that protects and manages administrator credentials in
the same way as bot credentials, using encryption and secure storage and automatic rotation; and allows
isolation and monitoring of administrator activity.