Dynamic Risk Assessment in Information Systems: State-of- The-art

Nowadays Risk Management is a common practice in the Information Systems security field. It is usually supported by a Risk Assessment process, which is done at regular but unfortunately large intervals. This lack of a continuous Risk Assessment process in an ever-changing environment, such as Information Systems, tends to make Risk Management a more complex and less accurate task. In this paper different existing approaches to face Dynamic Risk Assessment and Management are recapitulated along with their pros and cons and finally, future action lines are proposed in order to avoid existing gaps.