Causes of Human Errors in Information Security: A Grounded Theory Study

Abstract

In this paper, the role of human errors in the field of information security is discussed.The latter has attracted much attention from information security researchers in the recent past. According to current statistics, human errors are a major component of problems in information security, with 68% of breaches involving a non-malicious human element (Verizon Business, 2024) and the global average cost of a data breach reaching $4.88 million (IBM, 2024). In spite of such alarming statistics, there has been comparatively little empirical research on the role of human errors in information security. This is particularly evident at organizational level, due in large part to the unwillingness of organizations to share information and statistics on security issues.In this paper, grounded theory has been employed as a research methodology to investigate the main causes of human errors in information security.Information security experts (103 in total) from around the globe were asked a series of open-ended questions and their responses were used to develop a detailed list of human errors. This paper represents an important contribution to our understanding of the causes of human error in information security.