# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
## 5 Implementation, Results, and Analysis
### Testing and Discussion  
The comparison results of the implemented RS approach indicate that SD-WAN has the lowest risk score based on mitigation to risk averaging (as highlighted in Equation (1)), which is presented in Figure 2, and this is supported by Figure 3 (OT WAN-weighted risk) and Figure 4 (OT WAN-weighted mitigation). The results also indicate that the weighted mitigation score (complimentary percentage, the lower the better) of SD-WAN outweighs its risks. SD-WAN score has a marginal gap compared to its predecessors which are MPLS, leased line, and VPLS because of the security features SD-WAN innately has.  
RS presented in Figure 2 shows that SD-WAN, MPLS, and leased line have the lowest risk scores, meaning these technologies will provide a better and secure OT WAN connectivity avoiding DoV, DoC, and DoS attacks and ensuring more availability. On the other hand, VPLS, DMVPN, IPSec VPN, LTE/5G, Satellite, and LoraWAN technologies fall behind in terms of their mitigation capabilities, like network visibility, network management, and threat intelligence, which in turn makes the OT infrastructure more susceptible to risk, which can be seen in both Figures 3 and 4, yielding to a higher risk score as presented in Figure 2.  
The weighted risks which can contribute to DoV, DoC, and DoS attacks as presented in Figure 3 show that MPLS, leased line and SDWAN have the lowest risk. The risk heat map graph in Figure 5 highlights the risk breakdown, showing what risk variables contributed the most to Figure 3 values. For example, from Figure 5, we see that SD-WAN has multiple moderate risk scores, which are zero-day, incident impact when down, software, hardware, attack surface, recorded vulnerabilities, and, lastly, third-party dependencies. These risk variables show what can be improved in SD-WAN and can be mapped on its mitigation features if this has been remediat  
Figure 4: OT WAN weighted mitigation (equivalent risk) comparison across technologies.  
Figure 3: OT WAN weight risk comparison across technologies.  
Figure 2: Risk score comparison across WAN technologies.  
visible in Figure 5 that other WAN technologies, other than MPLS and leased line, have higher risks which is also highlighted in Figure 3.  
The weighted mitigations which will help on preventing DoV, DoC, and DoS attacks as presented in Figure 4 show what technologies have the best mitigation features. SD-WAN, MPLS, and leased line have the top-three best mitigation features. This is supported by the mitigation heat map, in Figure 6, which can also be used in assessing a specific technology against a predefined feature requirement to have in each OT infrastructure. Figure 6 also shows that, among all nine OT WAN technologies, SD-WAN has the best mitigation features, which only falls behind on security awareness, which means engineers will need further training to adapt to this technology and resource budget, meaning it is moderately costly to implement.  
If future changes are made to the OT infrastructure, the severity of risks and the effectiveness of mitigations may fluctuate based on the cybersecurity posture of the OT WAN. This could lead to either higher mitigation weights and lower risk weights if the security has been enhanced through continuous improvement, or higher risk weights and lower mitigation weights if an unforeseen vulnerability has been introduced due to the WAN modification. It is important to note that this paper focuses solely on the WAN aspect of the OT infrastructure, meaning any changes beyond the WAN (such as internal traffic) are outside the scope, as the weights are specifically assigned to WAN devices managing inbound and outbound external traffic.  
Figure 5: Heatmap of risk across technologies (sorted by highest risk).