# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
## 4 Proposed Risk-Assessment Approach
### Risk and Mitigation Values per Selected Technology  
Tables 6 and 7 represent the qualitative risks and mitigations assumptions based on the current OT infrastructure setup (i.e., related to WAN technology extension). The values are based on the metric scaling shown in Table 8, which is meant to follow NIST scoring. The values will be used in Equations (8) and (9) to calculate Rn and Mm, respectively. As Rn and Mm are probabilities that take values between 0 and 1, risk and mitigation are normalized. Weighted risk and weighted mitigation will then be calculated using Equations (2) and (3), respectively. The scores in Tables 6 and 7 are not standard or fixed values; for clarity and simplicity, they were assigned based on research insights into WAN technology and were guided by NIST and ISA/IEC frameworks. In a real scenario, this will \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Method** & **Method** & **Method** & **Method** & **Method** & **Method** & **Method** & **Method** & **Method** \\ \hline High Priority & Security Measures within the Device & 4 & 4 & 5 & 80 & 0.0892 & & It ensures the integrity of devices operating within the OT environment. Ensures that systems are up to date and able to validate the latest security patches to mitigate vulnerabilities. Critical for maintaining the confidentiality and integrity of data in transit and at rest. & Implementing mechanisms to detect and respond to security incidents. This ensure that data and system states can be restored in the case of an event. It enhances the network’s fault tolerance, therefore enabling it to sustain and recover from faults quickly. Ensures continuity of operations in the event of system failures. Keeping the system updated with the newest threat intelligence to help prevent an attack. & & & & & & \\ Low Priority & Configuration Management Management & 3 & 4 & 1 & 12 & 0.0134 & & Manages the security policies and configuration enforcement. & \\ Low Priority & Security Awareness & 4 & 4 & 1 & 16 & 0.0178 & & & & \\ Low Priority & Third-Party Vendor Risk Management & 3 & 3 & 2 & 18 & 0.0201 & & & & \\ Low Priority & Regulatory Environment Compliance & 2 & 2 & 2 & 8 & 0.0089 & & & & \\ Low Priority & Compatibility with SIEM Systems & 3 & 3 & 1 & 9 & 0.01 & & & & \\ Low Priority & Resource Budget & 2 & 2 & 2 & 8 & 0.0089 & & & & \\  & & & & & 897 & 1 & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: _Cont._be based on experts' assumptions or most effectively based on the existing risk assessment framework. The values were decided based on OT WAN environments considering their location, technology setup, and availability of the said technology. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline SD-WAN & 4 & 4 & 4 & 5 & 4 & 4 & 4 & 4 & 4 & 3 & 4 & 4 & 4 & 3 & Proposed \\ Satellite & 3 & 3 & 3 & 2 & 3 & 3 & 2 & 2 & 3 & 3 & 3 & 3 & 3 & 2 & [74, 75] \\ WAN & 3 & 3 & 3 & 2 & 4 & 3 & 2 & 2 & 2 & 3 & 2 & 3 & 3 & 2 & 2 & [76, 77] \\ LoRaWAN & 3 & 3 & 3 & 2 & 4 & 3 & 2 & 2 & 2 & 3 & 2 & 3 & 2 & 2 & [76, 77] \\ Private & & & & & & & & & & & & & & & \\ LTE/5G & 3 & 4 & 3 & 3 & 2 & 3 & 3 & 3 & 3 & 3 & 3 & 3 & 3 & 2 & [78, 79] \\ Networks & & & & & & & & & & & & & & & & \\ MPLS & 4 & 5 & 4 & 4 & 3 & 3 & 3 & 4 & 4 & 3 & 3 & 4 & 4 & 3 & 2 & [80, 81, 82, 83] \\ Lase & 4 & 5 & 4 & 4 & 3 & 3 & 3 & 4 & 4 & 3 & 3 & 4 & 4 & 3 & 2 & [80, 81, 82, 83] \\ Lime & 4 & 5 & 4 & 4 & 3 & 3 & 3 & 4 & 4 & 3 & 3 & 4 & 4 & 3 & 2 & [80, 82, 83] \\ DMVPN & 4 & 4 & 3 & 3 & 5 & 2 & 3 & 3 & 3 & 2 & 3 & 3 & 4 & 4 & 3 & 4 & [84, 85] \\ IPSec & 4 & 4 & 3 & 3 & 5 & 2 & 2 & 2 & 2 & 2 & 3 & 3 & 4 & 2 & [86, 87, 88] \\ VPLS & 4 & 5 & 4 & 3 & 4 & 2 & 3 & 3 & 4 & 2 & 3 & 3 & 4 & 4 & 3 & 3 & [89, 90] \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Risks when using WAN technology to extend OT.