Protect yourself while shopping on Cyber Monday

Cyber Monday hits tomorrow when shoppers are expected to swarm to the Internet in search of online deals and all things gifty.

The busiest day of the virtual shopping season comes with lots of bait -- free shipping, crazy discounts, hourly specials.

And across the country, workers will steal some time to search online for the perfect present.

From now through December, more than 68.8 million people with Internet access at work will shop for holiday gifts, according to a survey published by Shop.org, a division of the National Retail Federation.

If you think that doesn't add up, think again.

Employees plan to spend almost two full days -- 14.4 hours -- shopping from their desks this holiday season, according to a survey conducted by Information Systems Audit and Control Association, a non-profit IT professionals group.

All that time online has a price tag.

It means a loss of productivity and threatened network security for employers, as well as increased chances of identity theft for workers.

"A lot of the risks that are [from online shopping] are not necessarily focused on by the employee or the employer," said Marios Damianides, past international president of Information Systems Audit and Control Association. "There is a lot of convenience in doing shopping online. The convenience needs to be balanced with some considerations for safety."

Despite the economy, the enticements to shop tomorrow are at record levels.

This Cyber Monday, 87.1 percent of retailers are expected to have a special promotion, up from 83.7 percent last year and 72.2 percent in 2007, Shop.org said.

Caution should outweigh savings, or implied savings.

"People are so generous and open-minded about making purchases this time of year that they forget their own self-preservation," said Mark Bowser, a computer crimes specialist with Richmond-based National White Collar Crime Center.

Employees need to be concerned about identity theft when they order online:

• Shop at established sites, or do research about the retail outlet before placing an order online, Bowser said.

• Make sure your anti-virus software is updated.

• Don't follow links or open attachments you don't recognize.

"The e-mails you get from these bargain sites are not necessarily real," Damianides said. "It could be from a reputable site or it could be a dummy link from a fraudster. A lot of these have embedded viruses and ways of capturing your private info."

• Make sure your online banking accounts are properly password protected. Use different passwords for different accounts.

• Don't save login or password information on your browser or use programs that automatically fill in information, such as name, address and credit card info, said Todd Whitlock, co-owner of The Help Desk Co. in Richmond.

"Sometimes malicious code can get on someone's computer and look for these nuggets of info and transfer that info out of their computer," he said.

And don't assume any site you are shopping on is secure. "It's only as secure as the business running it," Bowser said.

Look for a Web address to begin with https. The 's' stands for secure. If a site is secure in Internet Explorer, a lockbox icon should appear in the address bar. Make sure the site stays secure.

Shoppers need to "keep an eye out to make sure they don't get transferred off that site," Whitlock said.

Shopping on eBay or Craigslist is fine, but people should do some research and "use the same precautions you would as if buying from a stranger," Bowser said.

Ordering items from a mobile phone is a no-no.

Browsers on desktop and laptop computers are more secure than those on smartphones. Data on cell phones tends to be less encrypted, which could reveal sensitive information to outsiders if you order things with your credit card on your phone.

"You're opening yourself up a little more if someone is phishing," Damianides said. "Think what it is you're giving away when you're giving your credit card over the Web."

For employers, barring online shopping outright may not be the best policy. You could cause more harm than good.

"The reality is that if you do block it, there are innovative ways an employee can get around a firewall," said Damianides, a partner in technology and security risk services at Ernst & Young in New York.

Consider explaining to employees how online activities can threaten a company and why it is not supported.

If you allow shopping, set up an online sandbox, a dedicated line that allows employees to access the Web without allowing hackers or others access to your network.

Come up with an acceptable use policy when it comes to the Internet and have employees sign it yearly so that it is fresh in their minds.

Companies can also install a content filtering system that will bar hazardous sites and control how, who and when certain sites are accessed, Whitlock said.

Make sure the information technology department is installing the latest virus protection updates. They should also watch for unusual traffic from unexpected addresses or sources, which could indicate a virus or spyware.

Above all, be vigilant.

"We sometimes take security for granted," Damianides said. "A lot of times we believe the company is taking care of security. A lot of it has to be our responsibility."

Contact Emily C. Dooley at (804) 649-6016 or .