# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
## 4 Proposed Risk-Assessment Approach
### OT Risks and Mitigations Prioritization and Priority Weighting  
Prioritizing the risks to implement the mitigation process chronologically based on severity is essential. This is needed to properly scale implementation progress and to measure effectively the efficiency of the deployed solution. It is best to align it with the recommendations in NIST SP 800-82 Rev. 3, which provides guidance on securing OT systems while addressing unique performance, reliability, and safety requirements. It also incorporates the principles from ISA/IEC 62443, which focuses on securing industrial automation and control systems by managing risks associated with these environments [19, 73]. Tables 4 and 5 provide OT risks and mitigations prioritization, respectively, which are based on NIST SP 800-82 and ISA/IEC 62443. This will be used in the RS computation defining both risk and mitigation variables based on their priority level, and showing how OT WAN devices or solutions will be assessed before they can be deployed in the OT Infrastructure. The prioritized risks and mitigations are the ones identified in Table 3 mapping the NIST and ISA/IEC standards considered for OT WAN. Tables 4 and 5 illustrate the distribution of priority weights for risks and mitigations, respectively, which will be utilized in Equations (2) and (3) for calculating the risk score (RS) as shown in Equation (4). The weights range from 0 to 1, with a total sum of 1 for the overall weight, signifying that a higher weight value indicates greater priority in risk and mitigation calculations. Both risk and mitigation weights are based on qualitative and quantitative assumptions informed by NIST CSF and ISA/IEC 62443. They are qualitative because each OT infrastructure will prioritize risks differently, but since the proposed method is based on the OT risk-assessment standard framework, it is also quantitative in nature. The scoring is influenced by the priorities outlined by NIST and ISA/IEC 62443. However, the weight values may vary in actual OT environments based on expert assumptions and real occurrences. A risk/mitigation value is attributed to every attack (\(S_{DoV}\), \(S_{Doc}\), and \(S_{Dos}\)). The values are associated with a priority level (1 to 5) that can be high (4 or 5), medium (3) or low (1 or 2) (see Tables 4 and 5). The values assigned to \(DoV\), \(DoC\), and \(DoS\) are based on how the risk affects its occurrence. The same is expressed in mitigation but to emphasize how effective it can prevent DoV, DoC, and DoS. A combined score multiplying the 3 values is then calculated following Equation (5). The weight for every risk (i.e., \(WRn\))/mitigation (i.e., \(WMm\)) is then calculated by dividing the combined score for a given risk/mitigation factor by the sum of all combined scores as depicted in Equations (6) and (7), respectively. The calculation concept is inspired from NIST (see Section 4.3), but the scaling is based on the proposed approach. \[Combined\ Score=S_{DoV}\ *\ S_{Doc}\ *\ S_{DoS} \tag{5}\]  
\[WRn=\frac{Risk_{Combined\ Score}}{\sum Risk_{Combined\ Score}} \tag{6}\]  
\[WMm=\frac{|Mitigation\ Combinined\ Score}{\sum Mitigation\ Combinined\ Score} \tag{7}\]