# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
## 2 Related Works
### Existing Risk-Scoring Techniques
& Time-consuming to model the impact of OT for  
Fault Tree Analysis (FTA) and Event Tree Analysis (ETA) method can predict failures based solely on design, without the need for physical components, by analyzing single failure paths for each asset or event [53] (pp. 83781-83793), [54]. Failure Modes and Effects Analysis (FMEA) prioritizes risks using risk priority numbers but primarily focuses on identifying failures rather than mitigating events. While it performs detailed analysis per asset, it tends to be retrospective and is not typically employed for predictive risk assessments [55] (p. 106480), [56]. Quantitative risk analysis (QRA) applies numerical scaling to assess probability and impact, concentrating on quantifying risk rather than detailing mitigation. QRA usually evaluates scenarios that encompass more than single assets while offering predictions using statistical and probabilistic models [57] (pp. 127-139). CVE-based scoring or CVSS assigns scores ranging from 0 to 10, with higher scores indicating greater risk. This method evaluates vulnerabilities specific to each asset without considering mitigations, making it suitable for predictive analysis based on known vulnerabilities, which may be vendor-dependent [58] (pp. 353-356), [59] (pp. 4486-4495). The Risk Matrix is a threat likelihood and impact matrix that operates on a scale from 1 to 25. It primarily assesses risks without explicit mitigation and can be applied for predictions in hypothetical scenarios [60] (pp. 29775-29818). Hazard and Operability Study (HAZOP) is used for qualitative risk assessment, classifying risks descriptively instead of numerically. It includes safeguard ratings but is generally applied at a system-wide level rather than for individual assets and is not suited for predictive analytics without modifications [61] (pp. 266-279), [62]. Bow-Tie Analysis does not provide direct scoring; instead, it visually represents threats and mitigation measures, displaying them graphically. It broadly maps threats rather than focusing on individual assets, making it more appropriate for mapping existing systems rather than for predictive analysis [63]. The MITRE ATT&CK for ICS Framework does not offer numerical scores, but it does provide a qualitative or descriptive severity scale for various attack techniques. It does not aim to assess the vulnerability of specific assets but rather offers mitigation strategies for identified attack techniques. Designed for operational scenarios, it is not ideally suited for predictive modeling without further component analysis [64] (pp. 1-6), [65] (pp. 1-6). In summary, current risk-scoring techniques lack a detailed approach for calculating risk while accounting for mitigation factors specific to each WAN device. Most existing methods do not offer predictive risk scoring to evaluate risks and mitigations when a WAN device is deployed in OT, which is crucial during the planning phase before acquiring such devices. This paper proposes a new risk-scoring method to address these limitations. While FTA/ETA is the closest existing technique, it does not provide guidance on how to compute probability variables or how mitigation factors influence risk scoring. This paper will also rectify these issues through the proposed risk-scoring method.