Survey: Employees Will Shop Less Online But Take Bigger Risks During Holiday Season

Employees in the United States plan to spend less time shopping online from a work-supplied computer this holiday season than they did a year ago, but more of them are engaging in risky online behavior, according to the third annual “Shopping on the Job: ISACA’s Online Holiday Shopping and Workplace Internet Safety Survey.”

Employees are expecting to spend an average of 6 hours shopping from a work computer or mobile device this holiday season vs. 14 hours in 2009, with 20 percent planning to spend 9 hours or more. But, there is an increase this year in the number of employees who take risky actions online, such as clicking on an e-mail link or providing their work e-mail address when shopping online, and 42 percent report accessing social network sites from their work-supplied computer or mobile device.

“Employees who shop online reduce productivity -- especially from Black Friday through mid-December, when 71 percent of them make their holiday purchases -- and open the door to social engineering and phishing attacks, malware, and information breaches that can cost companies millions and inflict severe damage to their reputation,” said John Pironti, CISA, CISM, CGEIT, CRISC, security advisor with ISACA and president of IP Architects, LLC.

This year’s survey also found that almost half (47 percent) of those who will shop online with company devices will do so using a portable device, such as a notebook computer, tablet or smart phone. This increases a company’s security risk because these devices are often used on wireless networks outside of a protected corporate network. They also are more easily lost or stolen, and contain corporate data that are typically not encrypted.

“The number of portable computers and mobile devices in the workplace is increasing, so companies need to create realistic security policies that let employees stay mobile without compromising the company’s intellectual property. To balance productivity and security, the IT mantra should be embrace and educate,” said Mark Lobel, CISA, CISM, mobile security project leader with ISACA and a principal at PricewaterhouseCoopers.

Employees say the top three reasons for shopping online at work are that it is a convenient use of lunch/break time (38 percent), they are working long hours and don’t have time to shop from home (17 percent) and they are bored at work (11 percent).

Security is not a major worry for survey participants, with only 3 percent citing “better security” as a reason for shopping using a work computer. Under two-thirds do not use secure browsing technology on work-supplied devices. Forty-one percent assume their IT department updates their security patches.

This attitude is especially common among digital natives, who have grown up with the Internet. Young adults (ages 18-34) in the survey are the most likely to shop online using work-supplied computers or mobile devices and are more inclined to use their personal computers for business.

“Digital natives are comfortable with blurring the lines between work and play, which poses new challenges for their employers,” noted Robert Stroud, CGEIT, international vice president of ISACA and service management and governance evangelist at CA Technologies. “This generation is happy to use their own computer at work or use a work-supplied smart phone for shopping or social networking, so they need a new kind of IT security policy that balances access and control.”

A separate global survey of 837 U.S. business and information technology (IT) professionals who are members of ISACA, conducted during the same time period, shows that two-thirds of respondents believe their organization loses $1,000 or more per employee as a result of an employee shopping online during work hours in November and December. Approximately one-third put the number at $15,000 or higher.

For mobile devices, an overwhelming majority (85 percent) ranked the risk of using a mobile shopping app on a work-supplied device as high or moderate. Despite that, 43 percent allow employees to use work-supplied mobile devices for personal use and 45 percent let employees use their own mobile devices for work.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation.

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols.