# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
## 3 Background
### OT WAN Device Risk Identification and Mitigation  
Availability risks in WAN devices with respect to OT infrastructure must be identified and mitigated. This section gives a description of the several techniques to identify and mitigate OT WAN device risks. One of the major vulnerabilities in WAN devices, according to NIST, includes firmware exploits. Under ID.RA-1 in the NIST Cybersecurity Framework, it is stated that vulnerabilities to known threats should be collected, correlated, and communicated [19]. Similarly, ISA/IEC 62443 stipulates that systems should be designed to minimize exposure to these device vulnerabilities. Another notable risk is through attack surfaces caused by unrecorded devices, nonstandard configurations, enabled unused protocols, and external access exposure. NIST CSF ID.AM-2 indicates the need for an inventory of software platforms and applications in an organization [19]. ISA/IEC 62443 3-3 SR 7.3 also emphasizes the importance of reducing attack surfaces to a minimum [6]. Zero-day vulnerabilities can also be directly attributed to the firmware or software of devices. NIST CSF DE.CM-4 emphasizes the importance of the device's ability to detect malicious code, and ISA/IEC 62443 4-1 SR 1.4 establishes the same security management in mitigating this risk [6,19]. Additional considerations include the incident impact when a device is down. NIST CSF ID.BE-5 addresses the identification of resilience requirements to support critical services [19]. ISA/IEC 62443 2-1 SR 2.6 suggests that an analysis of the consequences of such incidents should be conducted as part of the process [6]. Third-party dependency, where an organization may depend on external software or hardware, can also be a risk. NIST CSF ID.SC-1 implies that identifying and evaluating suppliers and partners should be included in the risk assessment process [19]. A similar recommendation from ISA/IEC 62443 2-4 SR 1.1 is that dependencies on third parties should be documented or recorded [6]. Hardware failure risks must be considered, and NIST CSF PR.DS-4 proposes that there should be enough capacity to support availability in case of hardware failure [19]. Similarly, ISA/IEC 62443 3-3 SR 7.4 states that system designs should be resistant to hardware failures [6]. Physical protections against environmental risks, such as the ability of the device to withstand temperature and humidity, are addressed in NIST CSF PR.PT-5 and ISA/IEC 62443 3-3 SR 5.1, respectively [6,19]. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  
Another notable risk is human error, such as misconfigurations, which can be mitigated through response and recovery plan testing guided by NIST CSF PR.IP-9 and ISA/IEC 62443 2-4 SR 3.1, and effective training [6, 19]. Software-related risks must be patched to prevent firmware complications. According to both NIST CSF PR.IP-12 and ISA/IEC 62443 3-3 SR 7.5, this requires support for vulnerability and update management [6, 19]. Access control risks are associated with the management of user access and permissions. NIST CSF PR.AC-1 involves the identity and credential management process [19], while ISA/IEC 62443 3-3 SR 1.1 ensures capabilities for user authentication are in place [6]. Communication network risks, which depend on both the availability and integrity of information, can be mitigated through NIST CSF PR.PT-3 and ISA/IEC 62443 3-3 SR 3.2 to protect system access and communications [6, 19]. These mitigation strategies involve deploying security devices and solutions, including firewalls and encryption, which are addressed in NIST CSF PR.IP-3 and ISA/IEC 62443 3-3 SR 3.1 [6, 19]. Implementing redundancy and failover capabilities as stated in NIST CSF PR.DS-4 and ISA/IEC 62443 3-3 SR 5.2 [6, 19] are crucial to OT infrastructure. The effectiveness of policy and configuration management is observed in NIST CSF PR.IP-1, along with ISA/IEC 62443 3-3 SR 1.8, providing guidelines for maintaining baseline configurations [6, 19].