How to secure an automation in UiPath studio

News Tutorials
, ,
1

RPA is about enabling robots to perform processes and activities being done by humans
which means
Robots would also have access to confidential data/credentials
And if that combines with any faulty design of automation workflows
can pose a Security Threat…

And security is non-negotiable factor for any enterprise or organization.

Thus, understanding potential security risks (as outlined below) associated with a typical RPA project is important.

  1. Robots having access to credentials normally used by human workers.
  2. Robots have access to privileged information: personal data of company staff, financial data.
  3. Unauthorized modifications of automation workflows in the development or testing phases.
  4. Unauthorized modifications of automation workflows or runtime parameters in the production environment.

And below are the guidelines and features that UiPath has developed to address security concerns at studio level.

Guidelines are best practices that Uipath recommends when setting up or using the RPA solution as below:

  1. Having proper #CodeReview can ensure that process running on live data is safe and no security breaches are possible. For example. Ensuring proper usage of credentials, preventing data sharing outside the trusted scope, avoiding hard coded values.

  2. Having isolation between development, testing and production environments. For example, ensuring RPA developers can’t adjust Robot settings or upload packages in production Orchestrator, ensuring dev studio is not connected to prod Orchestrator.

  3. Having version control in place to keep track of changes throughout RPA projects. For example, using source code control system(SCCS) such as TFS,SVN, GIT.

Features are characteristics that are embedded in the product or solution and implemented in order to enhance security and mitigate risks.

  1. UiPath offers a secure way to deploy packages to orchestrator.

Direct - when studio is connected to orchestrator and project can be published directly.

Indirect - when studio is not connected to orchestrator, so package will be save in local folder and then manually uploaded to orchestrator. Either of these methods require permissions to access orchestrator.

Hope this info helps.

Feel free to add your suggestions or any additional pointers…

9 Likes
2

Great pointers, @sonaliaggarwal47 :clap:

1 Like
3

Well said Sonali :heartpulse:

1 Like
4

Sonali,
onething if u add some more detail how it is providing security and what ways it is secured then it will be good…specifiy any special activities or tasks should be done to do this…It adds more detail info…

Iam just suggesting…ur post is excellent…

2 Likes
5

Hi @Keerthana_Boya,

Absolutely agree.

I would soon be posting a follow up tutorial around what all features/rules need to be enabled in studio that can help achieve this.

Thank you for dropping in your suggestion:)

Regards
Sonali

1 Like
6

Please share if the follow up tutorial was created…