I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network.
Below is the reasons I have come up with so far. This is still the rough list.
- The amazon Echo/Dot cannot be managed or audited
- As an IOT device, it could be susceptible to hacking
- Since the device is tied to an Amazon account, always listening, and unable to distinguish voices, someone could order something and there would be no recourse
- The microphone is very sensitive and there is no way to adjust the sensitivity, this opening up the echo to abuse
- The device is always listening, and recording which does not provide a reasonable level of privacy as detailed in our Acceptable Use Policy
- The device is always listening, recording and sending data to Amazon. This data can be subpoenaed
- No audible notification when it is listening and recording
- It increases the attack surface of our network
- Since it has the ability to connect to many other IOT devices, it becomes a conduit from less secure devices
Feel free to add any thoughts of what I missed as well.
I do not believe there is any reason we should allow them on our network. Has anyone's company addressed this issue, either through policy or any other ways?