3

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network.

Below is the reasons I have come up with so far. This is still the rough list.

  1. The amazon Echo/Dot cannot be managed or audited
  2. As an IOT device, it could be susceptible to hacking
  3. Since the device is tied to an Amazon account, always listening, and unable to distinguish voices, someone could order something and there would be no recourse
  4. The microphone is very sensitive and there is no way to adjust the sensitivity, this opening up the echo to abuse
  5. The device is always listening, and recording which does not provide a reasonable level of privacy as detailed in our Acceptable Use Policy
  6. The device is always listening, recording and sending data to Amazon. This data can be subpoenaed
  7. No audible notification when it is listening and recording
  8. It increases the attack surface of our network
  9. Since it has the ability to connect to many other IOT devices, it becomes a conduit from less secure devices

Feel free to add any thoughts of what I missed as well.

I do not believe there is any reason we should allow them on our network. Has anyone's company addressed this issue, either through policy or any other ways?

Improve this question
3
  • You may also consider how you manage patching / updating the device and data storage - your data is shuffled off to Amazon for processing, how does that fit with your data storage / legal requirements and then finally who has acess to amazon accounts linked to it
    – iainpb
    Feb 23, 2017 at 18:33
  • Patching and updating is done by amazon, with no control from us. as we do not have access to the data, it does not fit in with our data storage/legal requirements. the device is personally owned, so I would guess that it would be the owner of Echo/Dot's personal account.
    – orion3999
    Feb 24, 2017 at 15:11
  • Points 5 and 6 are partially incorrect about "always listening and sending data back to amazon." The "always listening" part is limited to local hardware trying to detect the activation phrase. Once activated, then further audio data is sent back to Amazon. Point 3 can be addressed with the addition of purchase PIN to authorize the purchases.
    – JesseM
    Feb 25, 2017 at 0:35

1 Answer 1

Reset to default
1

Your list is a great start! I'd argue enough risk assessment to justify a privacy/security denial request in most organizations. In addition: Are you looking at one country or multiple country's laws? How about Network segmentation? Privacy violations? Controls to insure confidential or company secrets from getting leaked? Even simple data such as products ordered to your company could reveal insights to competitors.

Improve this answer
3
  • I am currently only looking at a single country, I do think privacy is a big issue.
    – orion3999
    Feb 28, 2017 at 19:46
  • @orion3999 what industry are we discussing?
    – Kamic
    Mar 1, 2017 at 1:45
  • we are a retail company
    – orion3999
    Mar 15, 2017 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .