Week 6--IoT and Business

Does your company have an IoT policy? This is a question that was asked by Rafal Los in one of his recent articles. While the increased availability of IoT devices and the amazing things they can do certainly make them attractive to customers, should employees be allowed to bring them to the workplace? This is a question that businesses need to address--and there are several reasons they should reply in the negative:

• Many IoT devices record data. Mr. Los specifically referred to Amazon Echo, a device that is used to play audio and receive voice commands. The thing is, Echo is always on, always listening. While some people may not think this is a big deal at home, should such devices be allowed in businesses? The Amazon Echo and similar devices essentially create an environment that is constantly subjected to a microphone; other IoT devices have cameras, track location, and/or use (and possibly store) wireless passwords. Should such data-recording be allowed in a business, where sensitive or proprietary information can often be shared verbally?
• Internet of Things devices need, well, Internet. While many businesses have BYOD policies, should the influx of non-computer networking devices be allowed? Is the company aided by these new devices enough to warrant the additional bandwidth and network requirements needed to support them? This sort of question, Los notes, needs to be addressed.
• The Internet of Things has security problems. Over the past weeks, I think I've portrayed this concept rather well. (A recent article can highlight some IoT security flaws for the unconvinced.) Businesses' BYOD policies originally applied to devices like laptops and tablets, which have been subjected to security-related scrutiny for a while. Though they are far from perfect, there is at least accountability and pressure to be secure--unlike many IoT devices, which have immature security and are not being pressured by the market to become more secure. (See one of my earlier posts to get a better idea of IoT insecurity.)

As you can see, there are several good reasons to question the combination of IoT devices and businesses. While the right answer for each organization has to be determined on a case-by-case basis, there certainly seems to be enough evidence to support the idea that a separate IoT policy is a wise choice--and even a policy that restricts or prohibits IoT usage on-the-job altogether.