工作场所监控与内部威胁风险管理：法律限制与隐私损害
Workplace Surveillance and Insider Threat Risk Management: Legal Limits and Privacy Harms
AI总结：
本文探讨工作场所监控的法律限制与隐私损害，指出其虽服务于合法目的，但过度监控违法且会损害隐私，针对内部威胁（InT）提出提升监控透明度、开展培训及优化检测工具的建议。
AI中文摘要：
各组织采用工作场所监控以保护企业资产并监控员工生产力。本研究提出关于工作场所监控的两个核心论点：尽管监控服务于合法的组织目的，但过度监控可能违反法律要求和数据隐私原则；且工作场所监控的一项主要安全目标是检测内部威胁（Insider Threat, InT）。InT由拥有授权资源访问权限的人员构成，其有意或无意的行为可能损害或危及企业资产。本文研究InT角色以了解行为和心理检测标准，回顾员工监控工具与技术以描绘员工监控格局，探讨工作场所隐私法律、过度监控的实例及由此产生的隐私损害。该综述识别出与过度监控相关的研究缺口，包括产生的过多警报可能掩盖有意义的InT指标。本文最后提出建议，以提高工作场所监控透明度、实施InT培训计划以提升组织检测能力，并调整InT工具以检测相关心理和行为指标。
英文摘要：
Workplace surveillance is used by organizations to protect corporate assets and monitor employee productivity. This research presents two central arguments on workplace surveillance: although surveillance serves legitimate organizational purposes, over-surveillance can violate legal requirements and data privacy principles; and a primary security objective of workplace surveillance is the detection of insider threats (InT). InT are comprised of individuals with authorized resource access whose intentional or unintentional actions may damage or compromise corporate assets. This paper investigates InT personas to understand behavioral and psychological detection criteria. Employee surveillance tools and techniques are reviewed to characterize the employee surveillance landscape. Workplace privacy laws, examples of over-surveillance, and the resulting privacy harms are addressed. The review identifies research gaps related to over-surveillance, including the generation of excessive alerts that may obscure meaningful InT indicators. The paper concludes with recommendations to improve workplace surveillance transparency, implement InT training programs to improve organizational detection capabilities, and tune InT tools to detect relevant psychological and behavioral indicators.
