The good news is that your employees likely won’t be using quite as much work time to shop online for holiday gifts this year. The bad news is that those who do are increasingly willing to engage in risky behavior using your company’s computers.
These risky behaviors could make your company vulnerable to attacks from computer viruses , phishing scams and malware attacks, according to a survey conducted by Information Systems Audit and Control Association, (ISACA), an information technology professional trade group.
“Employees who shop online reduce productivity — especially from Black Friday through mid-December, when 71 percent of them make their holiday purchases — and open the door to social engineering and phishing attacks, malware and information breaches that can cost companies millions and inflict severe damage to their reputation,” said John Pironti, security advisor with ISACA.
Employees expect to spend an average of six hours shopping from a work computer or mobile device this holiday season versus 14 hours in 2009, according to the survey. But a sizable group (20 percent) plan to spend nine hours or more shopping on the clock.
The big concern for business owners is the increase this year in the number of employees who say they are willing to take risky actions online, such as clicking on an e-mail link or providing their work e-mail address when shopping online.
This year’s survey also found that almost half (47 percent) of those who plan to shop online with company devices will do so using a portable device, such as a notebook computer, tablet or smart phone. This increases a company’s security risk because these devices are often used on wireless networks outside of a protected corporate network . They also are more easily lost or stolen, and often contain corporate data that are typically not encrypted.
“The number of portable computers and mobile devices in the workplace is increasing, so companies need to create realistic security policies that let employees stay mobile without compromising the company’s intellectual property. To balance productivity and security, the IT mantra should be embrace and educate,” said Mark Lobel, mobile security project leader with ISACA and a principal at PricewaterhouseCoopers.
Employees say the top three reasons they shop online at work are that it is a convenient use of lunch/break time (38 percent), they are working long hours and don’t have time to shop from home (17 percent) and they are bored at work (11 percent).
Security is not a major worry for survey participants, with only 3 percent citing “better security” as a reason for shopping using a work computer. What’s worse, two-thirds do not use secure browsing technology on work-supplied devices. Forty-one percent assume their IT department updates their security patches for them.
This attitude is especially common among digital natives, who have grown up with the Internet. Young adults (ages 18 to 34) in the survey are the most likely to shop online using work-supplied computers or mobile devices and are more inclined to use their personal computers for business.
A separate global survey of 837 U.S. businesses and IT professionals who are members of ISACA, conducted during the same time period, shows that two-thirds of respondents believe their organization loses $1,000 or more per employee as a result of shopping online during work hours in November and December. Approximately one-third put the number at $15,000 or higher.
For mobile devices, an overwhelming majority (85 percent) of IT professionals ranked the risk of using a mobile shopping app on a work-supplied device as high or moderate. Despite that, 43 percent allow employees to use work-supplied mobile devices for personal use and 45 percent let employees use their own mobile devices for work.
To minimize the threats involved with online holiday shopping at work, the ISACA recommends companies take action.
It suggests employers warn employees of the following:
- Do not click on an e-mail or link that is from an unfamiliar sender or looks too good to be true.
- Be very careful with the company information on your notebook, tablet or smartphone; use a privacy screen shield on mobile devices.
- Password-protect your mobile device and its memory card.
- Make sure that the security tools and processes protecting your work-supplied mobile devices are kept up-to-date. If you're unsure, ask IT.
It recommends IT departments do the following:
- Team up with human resources to adopt an “embrace but educate” approach. Promote awareness of the security policy.
- Encrypt data on devices.
- Use secure browsing technology.
- Take advantage of industry-leading practices and governance frameworks such as the Business Model for Information Security (BMIS).
- Holiday Hopes: Small Business Prepares for Black Friday
- Small Business Saturday Encourages 'Shopping Small'
- Holiday Bonuses Take Back Seat to Customer Gifts