Take Steps to Avoid Threats Posed by Online Shopping

By Kathy Gurchiek Dec 4, 2008

HR professionals might want to dust off their organization’s policy on nonwork use of the Internet this holiday season. An estimated 72.8 million people will shop for holiday gifts from work in 2008.

The trend of employees who have Internet access to shop from the office keeps increasing. Three years ago, nearly 45 percent said they shopped online from work, according to a November poll of 8,758 consumers by BIGresearch for Shop.org, a division of the National Retail Federation (NRF).

Other polls—by information technology group ISACA and CareerBuilder.com—back up findings showing a significant number of workers will spend at least part of their work day shopping online for holiday gifts.

ISACA’s poll of 973 consumers in late September 2008 and 3,191 IT professionals in October 2008 found nearly two-thirds plan to shop online using their workplace computers during the 2008 holiday season.

CareerBuilder.com’s poll of 6,194 full-time U.S. employees in September 2008 and 3,061 hiring managers and HR professionals polled in August 2008 found nearly one-third of workers plan to do so in 2008.

Among those letting their fingers do the walking, 43 percent of those CareerBuilder.com surveyed expect to spend an hour doing so, 23 percent will spend two or more hours and 13 percent three or more hours.

“While employers are unlikely to terminate workers for online holiday shopping during the workday, employees should proactively police their personal Internet usage,” advised Rosemary Haefner, CareerBuilder.com’s vice president of HR, in a press release.

Employees need to be aware of their organization’s Internet policies, she said, noting that more than one-fourth of employers surveyed monitor the time employees spend online and the sites they visited.

Potential Security Problems

ISACA, previously known as the Information Systems Audit and Control Association, is an association for information technology governance with members in more than 160 countries.

It found that workers age 18-to-24—who make up the majority of Millennials—will spend up to five hours shopping online on their work computer. Close to half of its U.S.-based members think their company loses an average of $3,000 or more in productivity per employee from online holiday shopping at work.

Millennials also are the least worried about the vulnerability online shopping can have on workplace computers, ISACA found in its online survey.

“This survey clearly shows that younger employees are more likely to engage in online activities at work that put a business’s IT infrastructure at risk,” ISACA security management committee member Kent Anderson said in a press release.

“The fact that Millennials are planning to spend the equivalent of more than half a work day doing holiday shopping from their work computer, combined with their lack of concern for how secure their computer is, points to an urgent need for employee education.”

Some employers permit online shopping at work. That’s the case for 55 percent of those surveyed for ISACA, although respondents said their employers have no strategy for educating them about the risks.

Using the company e-mail address as the contact for a purchase—a practice by nearly one-fourth of those ISACA polled—can lead to security problems. It can open a computer network to a variety of threats and productivity wasters such as spam, phishing attacks and viruses, ISACA noted.

ISACA advises those shopping online not to allow sites to save their username or password, to use separate browser sessions for online shopping vs. work-related browsing, and to delete cookies from the computer after shopping.

In addition, it recommends having your IT department:

  • Train employees on safe computer use prior to the Christmas shopping season, followed by periodic reminders—26 percent don’t check or are unsure how to check a web site’s security before making a purchase, ISACA found.
  • Tailor education to match your employee demographics, attitudes and technology know-how.
  • Conduct formal risk and threat assessments and update your acceptable-use policy and security measures as appropriate.
  • Make sure patches are deployed, security functions are enabled, and firewall rules, intrusion detection system signatures and spam filters are updated regularly.
  • Monitor networks for high volume or suspicious traffic and respond immediately to threats.
  • Remind employees to “sound the alarm” if suspicious events occur.

Although not related specifically to online holiday shopping, strategies Society for Human Resource Management (SHRM) members shared on SHRM’s online bulletin board for nonwork Internet use included:

  • Providing an Internet café. One unidentified member said his/her employer provides four computers, not linked to the organization’s network, in an empty, extra-large cubicle that employees may use during lunch breaks.
  • Allowing access for all employees, but using computers with “blockers” to prevent access to “questionable sites.”
  • Installing firewalls, using good virus protection software, and working with a reputable IT consulting firm.

‘Facing a Dilemma’

The busiest hours for online shopping are noon to 4 p.m., according to the Purdue University Retail Institute, “No one really knows how many work hours are lost as workers shop online," said Richard Feinberg, a researcher with the Purdue Retail Institute, in a press release.

“Business is facing a dilemma. If they let shopping from work occur, they lose money and productivity. If business does not allow shopping from work, they may cause hostility and dissatisfaction in their work force, which also can lead to lost productivity, and other problems. It may be that allowing workers to shop on the job actually increases productivity."

NRF spokesman Scott Krugman thinks online shopping can help employee productivity in some cases.

“You have a couple of choices for your employees,” he told SHRM Online. “During their lunch hour they’re going to want to go out and shop—they can go to the mall, they can go to the local stores.

“It’s really hard to kind of balance your time when you’re out there shopping—or they can take 10, 15, 20 minutes during the workday by their phone and take care of what they need and still be very productive.”

Kathy Gurchiek is associate editor for HR News. She can be reached at kathy.gurchiek@shrm.org. Aliah D. Wright, an online editor/manager for SHRM, contributed to this report.

Related Resource:

Express Request: To receive resources on handling online use of work technology for holiday shopping, please use SHRM’s Seasonal Express Request service and select the key term “Winter: Cyber Monday Online Shopping (Dec 1).”


Job Finder

Find an HR Job Near You
Post a Job


Find the Right Vendor for Your HR Needs

SHRM’s HR Vendor Directory contains over 10,000 companies

Search & Connect