# A Risk Assessment Analysis to Enhance the Security of OT WAN with SD-WAN
###### Abstract  
This paper introduces a comprehensive risk assessment of various wide area network (WAN) technologies as applied to Operational Technology (OT) infrastructures, thus uncovering which WAN technology is best suited for OT to mitigate the risks of Denial of View (DoV), Denial of Control (DoC), and Denial of Service (DoS). A new risk weight-based evaluation approach is proposed following NIST CSF and ISA/IEC 62443 standard risk scoring (RS). In this approach, RS was modified by introducing new risk metrics, namely, risk (Rn), mitigation (Mm), risk prioritization (WRn), and mitigation prioritization (WMm) to create a specialized probability formula to assess risks on OT WAN infrastructure. The proposed formula has been implemented to automate data analysis and risk scoring across nine WAN technologies. The obtained results demonstrated that software-defined wide area network (SD-WAN) has the best security features that even overshadow its vulnerabilities to perform not just as a WAN solution but as a security solution against DoV, DoC, and DoS. Furthermore, this paper identifies and highlights what to prioritize when designing and assessing an SD-WAN setup. In addition, this paper proposes an SD-WAN-based architecture to reduce DoV, DoC, and DoS risks. operational technology (OT); industrial control systems (ICS); cyber physical systems (CPS); risk assessment; prioritization; software-defined wide area network; SD-WAN; OT security Article  
[PERSON]; [PERSON] A Risk Assessment Analysis to Enhance the Security of OT WAN  
SD-WAN. J. [PERSON] A.  
security lifecycle for Industrial Automation and Control Systems (IACS) [6]. Given that it shows how critical availability is, failing it imposes risk on both the safety and integrity of the industrial control systems (ICS) (and) cyber physical systems (CPS) [7]. Thus, it is important to understand how denial on ICS and CPS works. There are three denial attacks on ICS and CPS based on MITRE | ATT&CK which are Denial of Control (DoC), Denial of Service (DoS), and Denial of View (DoV) [8; 9; 10]. DoV disrupts the monitoring of ICS and CPS environments. This attack remains unnoticeable and recovers to normal once the adversary has completed the motive [11]. DoC prevents ICS and CPS operators from interacting with the process controls, leaving it momentarily unmanageable during the said attack [12] (pp. 249). The most crucial is DoS, which disrupts expected or natural device functionality and, in the worst case, would lead to ICS and CPS Permanent Denial of Service (PDoS) since IPS/ICS devices are sensitive to environmental change and can easily be manipulated [13; 14]. To achieve near 100% availability, ICS and CPS will need to implement several critical strategies and best practices developed from established standards. For example, ensure that important components have backups that can take over in case of failure through the use of redundant systems and data storage, as well as the use of redundant pathways of communication to avert a single point of failure [15]. Additionally, the design of fault-tolerant systems results in continuous operation even if some of the components fail; this makes the network resilient to unanticipated downtime [16]. Equipment downtime can be significantly minimized with regular maintenance checks, this ensures that systems are maintained with up-to-date security patches against known vulnerabilities [17; 18] (pp. 437-465). Another best practice is to divide a network into segments so it can contain breaches and limit their impact [19; 16; 20; 21; 22; 23; 24]. Network segmentation should isolate critical systems from IT networks, thus further limiting the adversary's entry-point to OT either on public or corporate IT networks [8; 9; 10; 25]. Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs) deployments do provide consistent tracking of system activity and network traffic [26; 27] (pp. 18-28).