3

I have been tasked with coming up with if we should or should not allow Amazon Echo/Dot devices on our network.

Below is the reasons I have come up with so far. This is still the rough list.

  1. The amazon Echo/Dot cannot be managed or audited
  2. As an IOT device, it could be susceptible to hacking
  3. Since the device is tied to an Amazon account, always listening, and unable to distinguish voices, someone could order something and there would be no recourse
  4. The microphone is very sensitive and there is no way to adjust the sensitivity, this opening up the echo to abuse
  5. The device is always listening, and recording which does not provide a reasonable level of privacy as detailed in our Acceptable Use Policy
  6. The device is always listening, recording and sending data to Amazon. This data can be subpoenaed
  7. No audible notification when it is listening and recording
  8. It increases the attack surface of our network
  9. Since it has the ability to connect to many other IOT devices, it becomes a conduit from less secure devices

Feel free to add any thoughts of what I missed as well.

I do not believe there is any reason we should allow them on our network. Has anyone's company addressed this issue, either through policy or any other ways?

  • You may also consider how you manage patching / updating the device and data storage - your data is shuffled off to Amazon for processing, how does that fit with your data storage / legal requirements and then finally who has acess to amazon accounts linked to it – iainpb Feb 23 '17 at 18:33
  • Patching and updating is done by amazon, with no control from us. as we do not have access to the data, it does not fit in with our data storage/legal requirements. the device is personally owned, so I would guess that it would be the owner of Echo/Dot's personal account. – orion3999 Feb 24 '17 at 15:11
  • Points 5 and 6 are partially incorrect about "always listening and sending data back to amazon." The "always listening" part is limited to local hardware trying to detect the activation phrase. Once activated, then further audio data is sent back to Amazon. Point 3 can be addressed with the addition of purchase PIN to authorize the purchases. – JesseM Feb 25 '17 at 0:35
1

Your list is a great start! I'd argue enough risk assessment to justify a privacy/security denial request in most organizations. In addition: Are you looking at one country or multiple country's laws? How about Network segmentation? Privacy violations? Controls to insure confidential or company secrets from getting leaked? Even simple data such as products ordered to your company could reveal insights to competitors.

  • I am currently only looking at a single country, I do think privacy is a big issue. – orion3999 Feb 28 '17 at 19:46
  • @orion3999 what industry are we discussing? – Kamic Mar 1 '17 at 1:45
  • we are a retail company – orion3999 Mar 15 '17 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.