Story image

Exclusive: SailPoint CEO on why bot identities need to be scrutinised

05 Sep 18

Companies are increasingly using bots to automate menial and repetitive tasks, freeing up employees to focus on more business-critical job roles.

In order to do this, bots are accessing data, making decisions on that data and then performing actions – but this access isn’t being scrutinised as it would be when staff are given access.

SecurityBrief spoke to SailPoint CEO Mark McClain about bot identity governance and what companies need to be aware of.

What are some of the most common enterprise use cases for bots at the moment and what permissions do they gain in these use cases?

Bots are enjoying a wave of popularity within today’s enterprises.

Our customers are using bots to automate repetitive manual business and IT processes, allowing IT teams to offload monotonous, time-consuming tasks and focus on other priorities.

Some of the current use cases we’re seeing are things like virtual assistants, customer service chatbots, order fulfillment, and travel booking for employees, meaning these bots have permissions that give them access to a variety sensitive customer, employee and enterprise data.

Why are these use cases being outsourced to bots?

These use cases are being outsourced to bots to save both time and money for enterprises that are working to drive business efficiencies and to keep pace with digital transformation. 

For example, an enterprise can outsource order fulfilment to a bot that can work faster than a human, with potentially less human error.

Enterprises that have tens of thousands of customers can save a lot of time and money by automating these menial tasks.

And that’s not a bad thing as long as these bots and their access are being appropriately governed and secured.

What are the disadvantages of using bots in these use cases?

Introducing bots to the enterprise introduces a lot of opportunities, but it also creates new areas of exposure.

These bots have access to mission-critical systems, applications and data, just like any other user within the organisation.

Because of this, governing their access in the same way an enterprise governs human users is imperative to remain secure.

From a security standpoint, a hacker could easily spoof a bot and as a result, access all of the applications and data that the bot has access to.

Even worse, if left unmonitored, hackers could also start requesting access to other critical applications within the organisation, creating even greater exposure.

What can organisations do to mitigate the risks they present?

Bots are acting just like their human counterparts in today’s enterprises, and they must be treated as such from a security perspective.

Enterprises need to tightly govern the access that bots have to their systems, applications and data.

Often, this will mean treating bots in the same way as contractor-based identities with policies that grant access to only the applications and data they need. 

It’s also important to realise that bots have a lifecycle in the enterprise, just like an employee or a contractor whose role may change or evolve as they move around the company (or depart).

As such, a bot’s lifecycle needs to be regularly reviewed, updated and ultimately decommissioned if the bot is no longer serving its purpose. 

This is the only way enterprises can continue to answer the important questions of who has access to what, who should have access, and what they’re doing with that access.

Should bots be governed by the same access and identity protocols as human employees?

Absolutely. A single identity platform should govern all identities – both human and non-human.

As the enterprise IT landscape continues to change, identity governance must also keep pace with these changes, particularly when it comes to expanding the definition of identities beyond employees, contractors and partners. 

With a comprehensive approach to identity governance, enterprises can govern all users (both human and non-human), all applications and all data.

This is the secure path forward for enterprises today.

Hillstone CTO's 2019 security predictions
Hillstone Networks CTO Tim Liu shares what key developments could be expected in the areas of security compliance, cloud, security, AI and IoT.
Can it be trusted? Huawei’s founder speaks out
Ren Zhengfei spoke candidly in a recent media roundtable about security, 5G, his daughter’s detainment, the USA, and the West’s perception of Huawei.
Oracle Java Card update boosts security for IoT devices
"Java Card 3.1 is very significant to the Internet of Things, bringing interoperability, security and flexibility to a fast-growing market currently lacking high-security and flexible edge security solutions."
Updated: Chch crypto-exchange Cryptopia suffers breach
Cryptopia has reportedly experienced a security breach that has taken the entire platform offline – and resulted in ‘significant losses’.
Sophos hires ex-McAfee SVP Gavin Struther
After 16 years as the APAC senior vice president and president for McAfee, Struthers is now heading the APJ arm of Sophos.
Security platform provider Deep Instinct expands local presence
The company has made two A/NZ specific leadership hires and formed several partnerships with organisations in the region.
Half of companies unable to detect IoT device breaches
A Gemalto study also shows that the of blockchain technology to help secure IoT data, services and devices has doubled in a year.
Stepping up to sell security services in A/NZ
WatchGuard Technologies A/NZ regional director gives his top tips on how to make a move into the increasingly lucrative cybersecurity services market.