Companies curb shopping online

The holiday shopping season is in full force, and online retailers are expecting record sales this year. But what's good news for online retailers may not bode well for companies concerned about security, employee productivity and bandwidth consumption.

Employees today do a lot of their online shopping on company time, using company systems. Retail association Shop.org and BizRate Research paired up on a study that estimates 37% of consumers will use Internet access at work to browse or buy gifts online this holiday season.

To make sure shopping sprees at work don't become a problem, some companies use Internet monitoring software, which IT executives can configure to prohibit or limit employee access to shopping sites.

The driver isn't only to curb unproductive employee habits. There also are security risks to consider. While picking out toys, electronics and apparel, employees can unwittingly be picking up spyware, adware and malware, such as Trojans and keystroke loggers.

Users may be directed to an unfamiliar merchant via a search engine, and that merchant may not be trustworthy or adequately protected, says Jeff Smestuen, IT network manager at Blue Bell Creameries. "Users don't have control over what type of additional, unwanted content they may be downloading from that site," Smestuen says.

Blue Bell limits how much time employees can spend on shopping sites, Smestuen says. The Brenham, Texas, ice-cream maker also blocks access to certain sites, such as eBay, because bidding tactics can distract employees for long periods, Smestuen says.

The software behind Blue Bell's Internet policies is from Websense, which lets Blue Bell set quotas that place time limits on users' surfing. Quotas start at 60 minutes and go up, depending on users' roles. If a user reaches the daily time limit, the Websense software blocks further access to the restricted sites. Blue Bell doesn't limit the times of day users can shop online - such as allowing access to shopping sites only before and after business hours or during lunch - but the Websense software would allow it to if required.

"We don't do it to Big Brother the employees, we do it to conserve our resources," Smestuen says. "We start cranking down the sites from a security and a bandwidth perspective first, then productivity second."

Communication critical

Lately there's a trend among companies to do less blocking and more monitoring of sites that don't pose a direct security or legal threat, such as shopping sites, says Susan Larson, vice president of global threat analysis and research at SurfControl.

Companies may block inappropriate content, such as pornography, but leave shopping, sports and travel sites accessible to users, Larson says. "The products have had to become more sophisticated to deal with all the various ways that network administrators want to work collaboratively with their own end users," she says.

With this approach, end-user education is critical. Companies that regularly communicate with users and take the time to explain new threats as they emerge do well, she says.