# Dynamic Risk Assessment in Cybersecurity: A Systematic Literature Review
## 3 Research Methodology  
According to NISTIR 8170 [14], cybersecurity is \"The ability to protect or defend the use of cyberspace from cyber attacks\". Hence, cybersecurity is the framework of securing anything that is vulnerable to hacks, attacks, or unauthorised access which mainly consists of computers, devices, networks, servers, and applications. It also refers to the protection of any kind of digital data.  
Such a definition of cybersecurity is provided by NIST 800-53 Rev. 5 [3], according to which, cybersecurity is \"Prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and non-repudiation\". The same Special Publication defines information security as \"The protection of information and information systems from unauthorised access, use, disclosure, disruption, modification, or destruction in order to provide confidentiality, integrity, and availability\".  
Although there is some overlapping between these two terms, cybersecurity refers clearly to the protection of any kind of electronic information, while information security is referring to the protection of any kind of information both in electronic and physical form, such as the counter-measures that should be applied in order to protect information stored in paper forms.  
Although in this respect, information security can be considered as a superset of cybersecurity and, therefore, papers about DRA in information security might also address cybersecurity-related aspects, in this review paper, we focused only on those with a clear orientation on cybersecurity.  
Considering the above, the initial set of papers was provided by SCOPUS using as a search string the keywords \"dynamic risk assessment\" AND \"cybersecurity\" or \"cybersecurity\" or \"cyber\" and \"security\". More specifically, our search string was: (TITLE-ABS-KEY (dynamic AND risk AND assessment) AND (TITLE-ABS-KEY (cybersecurity) OR TITLE-ABS-KEY (cyber AND security))), and it was conducted on the 21 May 2023. Based on this query, SCOPUS returned 271 papers for the period 2001-2023. Having completed an initial check based on the papers' abstracts, we eliminated 204 as not relevant to our query. Subsequently, we conducted a more comprehensive scrutiny of the residual 67 papers. This evaluation resulted in the identification of 51 papers specifically addressing topics pertaining to DRA within the realm of cybersecurity. Within the definitive set of 51 papers, a comprehensive total of 50 papers were considered appropriate for inclusion in our review. The sole remaining paper was excluded due to its lack of suggestion for any dynamic methodologies. Instead the excluded paper proposed an extension of the incident object description exchange format (IODEF) to IODEF-DRA, with the intention of enabling utilisation by DRA tools [15]. Figure 1 presents the outline of our research methodology.  
The following research questions (RQ) regarding the DRA models proposed in the literature were answered through our analysis.  
* What primary analysis methods are being used by the proposed DRA models?
* What are the domains or application areas to which the proposed DRA models were applied?
* Are the proposed DRA models based on quantitative or qualitative methods?
* What are the main sources of data that the studied models use?
* What is the maturity level of the proposed models?  
Each of the above research questions is succinctly summarised and juxtaposed with the findings obtained from other studies. This critical examination is expounded upon in Section 5, with dedicated subsections that scrutinise and contextualise the outcomes in relation to the existing body of research.