Amazon Ring: A Case of Data Security and Privacy

This case study is based off of CSA’s Top Threats to Cloud Computing: Egregious Eleven Deep Dive. The Deep Dive connects the dots between CSA Top Threats through the use of nine real-world attacks and breaches. Pulling from one of the case studies, this article provides a security analysis overview of the Amazon Ring data breach.

Attack Detail

Amazon’s Ring is a smart home security device that is incorporated into a doorbell. Included with the device are surveillance cameras and an easy-to-access app capturing all footage. This feature quickly became popular as a means of monitoring who’s at your home before opening the door and when you’re away.

However, Ring came under heat when the Ring Android app was discovered to contain third-party trackers sending out customers’ personally identifiable information to Analytics and Marketing, providing the possibility of data abuse for purposes such as profiling, surveillance, and data theft. The trackers found did not provide users with notifications of this happening, nor did it provide them the ability to provide consent on the data collection and transfer.

Technical Impacts

This observed unauthorized third-party access led to a breach of user privacy. Information that was collected and transferred for possible analytics and data mining activity include: user full names, email addresses, OS version and model, Bluetooth activity, local IP addresses, and more.

Given the type of data that was collected, there is a high possible risk that it can be used for advertising, data mining, user profiling, nation state surveillance, data mismanagement, and subsequent theft by threat actors.

Business Impacts

The Amazon Ring unauthorized third-party access had damaging impacts:

• Financial: There was financial loss from regulatory fines and class action lawsuits filed by angry customers for inappropriately handling their data.
• Operational: The Incident Response team took significant time and effort to remediate the incident. Additional risk comes from the possibility of the shared customer data to be abused.
• Compliance: Possible regulatory fines for non-compliance and potential lawsuits from customers.
• Reputational: The discovery provided negative publicity for the company and eroded consumer trust in the ability of Ring to protect their privacy.

Mitigation Strategies

To prevent future unauthorized access from third-parties, three mitigation strategies should be implemented:

Preventative Mitigation

1. Supply chain contracts should explicitly and clearly state information security requirements to safeguard customer data.
2. Review the governance and risk management policies of their partners to ensure risks transferred from other members are accounted for.
3. Implement annual third-party assessments to ensure the compliance and efficacy of policies and procedures. This can detect inappropriate practices from third-parties that could put the organization at risk.

Detective Mitigation

1. Conduct independent reviews and risk assessments annually to detect and correct nonconformities with the established privacy compliance obligations.
2. Proper testing to detect problems with critical features that could impact consumer confidentiality and trust.
3. Establish policies to review data flows of application. Proper inventory and review of data flows should reveal missing requirements: customer consent should be obtained before the collection and transferring of data.

Corrective Mitigation

1. Organizations should ensure they have defined Incident Response processes.
2. In the event of a third-party data breach, proper forensic procedures should be followed for evidence collection to support potential legal actions.
3. ALl customers impacted by a security incident should be notified and adequate provisions made to respond to customers seeking additional information.

For other case studies of recent attacks and breaches, read our blog about the 2020 Zoom breach and check out the full Top Threats to Cloud Computing: Egregious Eleven Deep Dive.