Employees plan to spend nearly two full working days (14.4 hours) on average shopping online from a work computer this holiday season, according to a survey conducted on behalf of ISACA, a nonprofit association of 86,000 information technology (IT) professionals. One in 10 plans to spend at least 30 hours shopping online at work. Convenience (34%) and boredom (23%) are the biggest motivators, according to those polled.
The second annual “Shopping on the Job: Online Holiday Shopping and Workplace Internet Safety” survey is based on online polling in September 2009 of 1,210 US consumers and 1,513 IT professionals. The IT portion of the study provides the business/IT department’s perspective, polling members of ISACA in nine countries: the US, Canada, Mexico, the UK, France, Germany, Hong Kong, India and Australia. The study, which was designed to capture insights about online holiday shopping at work and employee compliance with workplace policies governing online shopping, was conducted by M/A/R/C Research and ISACA, respectively. The M/A/R/C study results contain a margin of error of 3.9% at the 95% confidence level.
The survey found that fully half of those surveyed plan to shop online for the holidays using a work computer. The potential danger of shopping online is that it can open the door to viruses, spam and phishing attacks that invade the workplace and cost enterprises thousands per employee in lost productivity and potentially millions in destruction or compromise of corporate data.
Employees who shop online using a work computer are also likely to engage in other high-risk behaviors. Survey participants also bank online (51%), click on e-mail links redirecting them to shopping sites (40%) and click on links from social network sites (15%). Yet nearly one in five says they are not concerned that their online shopping habits may affect the safety of their organization’s IT infrastructure.
“With the Internet now available to almost any employee in the workplace, it’s unrealistic to think that companies can completely stop the use of work computers for online shopping,” said Robert Stroud, international VP of ISACA. “What companies can and should do is educate employees about the risks of online shopping and remind them of their company’s security policy.”
This survey also found that more than one in 10 Americans who use a mobile work device such as a BlackBerry or iPhone plan to use it for holiday shopping. The increasing use of mobile work devices for personal business such as shopping can lead to additional security issues and exposure to data loss for a company.
A significant percentage of those surveyed do not actively manage their work computer’s security. Thirty percent report that they leave security up to their company’s IT department. Of those who connect via a wireless connection, 30% don’t or don’t know how to check the security of wireless settings and just 21% personally check their work computer for the most recent security patches.
The separate ISACA survey of more than 1,500 IT professionals conducted during the same time period shows a major gap between what the IT department believes and what the employees are planning when it comes to online holiday shopping. Close to half (48%) of those in IT believe employees will spend just over one work day, or nine hours, shopping online from a work computer. One in four estimates that their company will lose US $15,000 or more per employee in productivity during this year’s holiday season.
ISACA recommends that employees and IT departments take the following steps to reduce the risk of spam, viruses and accidental downloading of backdoor “agents” that can highjack corporate data.
5 Tips for Safe Shopping From the Office Computer: Online shoppers
- Use your desktop PC – not your mobile device – to shop, because your desktop browser is likely to be more secure.
- Protect sensitive information like credit card numbers by password-protecting both your mobile device and its memory card.
- Make sure you update your anti-virus and anti-malware programs continually.
- Treat social networking sites with the same caution as other web sites – social sites are a growing target for fraudsters and virus writers.
- Be cautious of special offers. If it looks too good to be true, it probably is. Fake online offers and coupons may lead to harmful sites, so be suspicious.
5 Tips for Safe Shopping From the Office Computer: IT department
- Educate employees. Blocking sites can do more harm than good, causing employees to seek out less secure ways to get around your blockade. Education works better.
- Get employees on board with learning by teaching them how to protect both their work computers and their home computers.
- Reinforce what you teach by having employees sign an acceptable-use policy every year.
- Offer a “safe zone” for holiday shopping: Create an online sandbox that can be taken down after the holidays.
- Don’t wait until Cyber Monday to step up security. Think of “Cyber Season” as the time from September to January and be extra-diligent throughout that time.