When human resources plays big brother – rights and wrongs in employee surveillance

From an HR perspectives, employers want to ensure that if the worst happens, and there is an insider breach, they have taken all the steps they can to prevent that breach. What steps can an employer take in terms of vetting and monitoring? What is the downside if the employer is overly intrusive?