Amazon Echo/Dot on your network

Question

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network.

Below is the reasons I have come up with so far. This is still the rough list.

1. The amazon Echo/Dot cannot be managed or audited
2. As an IOT device, it could be susceptible to hacking
3. Since the device is tied to an Amazon account, always listening, and unable to distinguish voices, someone could order something and there would be no recourse
4. The microphone is very sensitive and there is no way to adjust the sensitivity, this opening up the echo to abuse
5. The device is always listening, and recording which does not provide a reasonable level of privacy as detailed in our Acceptable Use Policy
6. The device is always listening, recording and sending data to Amazon. This data can be subpoenaed
7. No audible notification when it is listening and recording
8. It increases the attack surface of our network
9. Since it has the ability to connect to many other IOT devices, it becomes a conduit from less secure devices

Feel free to add any thoughts of what I missed as well.

I do not believe there is any reason we should allow them on our network. Has anyone's company addressed this issue, either through policy or any other ways?

Answer 1

Your list is a great start! I'd argue enough risk assessment to justify a privacy/security denial request in most organizations. In addition: Are you looking at one country or multiple country's laws? How about Network segmentation? Privacy violations? Controls to insure confidential or company secrets from getting leaked? Even simple data such as products ordered to your company could reveal insights to competitors.