2009 Shopping On The Job Survey: Shopping on the Job: Online Holiday Shopping and Workplace Internet Safety

Shopping on the Job: Online Holiday Shopping and Workplace Internet Safety Results from a consumer survey of 1,210 US employees and a global business/IT survey of more than 1,500 ISACA members October 2009

US Consumer Survey

ISACA included 10 questions in a weekly national Omnibus conducted by M/A/R/C Research.

Fielded online between September 7 to 10, 2009.

1,210 respondents; 629 qualified for the remainder of the survey based on having shopped online using employer computers

Margin of error of 3.9% at the 95% confidence level

Nine-country ISACA Member Survey

More than 1,500 respondents who are business and IT professionals based in the US, Canada, Mexico, France, Germany, the UK, Hong Kong, India or Australia

Surveyed for second year in a row about employees’ online holiday shopping habits at work, and how their enterprises mitigate the IT-related risks

Key Findings—Consumer Survey

Americans are putting companies at risk in a number of different ways:

52% intend to shop online this holiday season using their work computers.

13% intend to holiday shop using their work mobile device (e.g. Blackberry, iPhone).

Those who are shopping online also:

Bank online (51%)

Click on e-mail links redirecting them to shopping sites (40%)

Click on links from social network sites (15%)

When it comes to online shopping, this year about one in 10 plan on doing more shopping using a work computer compared to last year.

Key Findings—Consumer Survey

On average, those who shop online at work will spend close to two full working days (14.4 hours) doing so from a work computer this holiday season.

One in 10 anticipate spending at least 30 hours shopping online on a company-issued computer.

The largest proportion of shopping occurs early to mid-December, when employees are down to the wire in getting holiday gifts (41%).

However, more than a quarter of employed Americans complete the majority of shopping from September through November (29%).

Convenience (34%) and boredom (23%) are the top motivators for online shopping while at work.

Key Findings—Business/IT Survey

Close to half believe employees will spend the equivalent of one work day or less shopping online at work during November and December.

This is in contrast to the nearly two full work days employees say they will spend shopping online from the office.

One in four business/IT professionals says that their organization will lose US $15,000 or more per employee in terms of productivity as a result of online holiday shopping at work.

Fewer than one in five organizations prohibit employees from shopping online using a work computer.

However, workplaces are cracking down on social networking—44 percent of companies prohibit employees from accessing sites like Facebook and Twitter.

Almost half of business/IT professionals say that their organization provides training on the security policy.

Yet, according the consumer survey, a third of employees don’t know if their company has a policy that prohibits employees from shopping online, and more than half (52%) do not think that their company has a policy in place.

Key Findings—Business/IT Survey

Tips for Online Shoppers

Use your desktop PC, not your mobile device, to shop, because your desktop browser is likely to be more secure.

Protect sensitive information, like credit card numbers, by password-protecting both your mobile device and its memory card.

Make sure you update your anti-virus and anti-malware programs continually.

Treat social networking sites with the same caution as other web sites—social sites are a growing target for fraudsters and virus writers.

Be cautious of special offers. If it looks too good to be true, it probably is. Fake online offers and coupons may lead to harmful sites, so be suspicious.

Tips for IT Departments

Educate employees. Blocking sites can do more harm than good, causing employees to seek out less secure ways to get around your blockade. Education works better.

Get employees on board with learning by teaching them how to protect both their work computers and their home computers.

Reinforce what you teach by having employees sign an acceptable-use policy every year.

Offer a “safe zone” for holiday shopping—create an online sandbox that can be taken down after the holidays.

Don’t wait until Cyber Monday to step up security. Think of “Cyber Season” as the time from September to January and be extra-diligent throughout that time.

Contact: