# Cybersecurity Access Control: Framework Analysis in a Healthcare Institution
## 4 Discussion
### Capabilities, Risk, and Support  
The PBSM framework is the most common model utilized, with 67% of survey respondents utilizing the PBSM castle and mote style topology, also commonly referred to as a \"Defense-in-Depth\" (DiD) or \"Layered Security\". The DiD delineates trusted vs. untrusted assets based on the logical location in the network, physical controls, and administrative policy [15]. This study centers on the network dimension of the model, with the segmentation implementation conducted at a macro-segmentation level organized around security zones. The concentric circle diagram depicted in Figure 2 and tailored for this study illustrates the layers of a DiD. Figure 2 delineates the trusted and untrusted network segments denoted by green and gray shadings, respectively, with a protective or access barrier delineated in orange separating them. The simplified model showcases the macro-segmentation facet of the PBSM framework capabilities and underscores the open architecture of the design. Through this openness, PBSM offers capabilities around decreased overhead and minimal impact on users and operations. Devices deployed within a trusted ring (e.g., green ring) have unrestricted network access irrespective of the assigned numerical value (i.e., subnet or IP address) or medium types such as Local Area Network (LAN) and Wireless Local Area Network (WLAN). These trust zone devices only confront access restrictions when traffic needs to pass through a defense barrier (e.g., orange ring), such as a firewall, network device-enforced access control list (ACL), or proxy server. Most defense barriers necessitate a review and approval process, enabling manual implementation by an IT professional. Under a PBSM, Company X adheres to the review and a manual implementation procedure, averaging 336 monthly engagements in 2023, as depicted in Figure 3.  
According to the survey findings, PBSM operations encounter an average of 10 support tickets daily, with approximately 6.67 support hours devoted daily to managing policy changes. Furthermore, the survey indicates that after-hours support engagements average around 3.33 per week. Company X's PBSM places defense barriers primarily between DC assets and the internet. The model facilitates most change requests to alter a host's  
Figure 2: PBSM ring model. access to restricted assets or services within DCs (i.e., services with controlled or exclusive access). Core services (e.g., DNS, DHCP, Active Directory, etc.) and general internet traffic (e.g., SSL/TLS) are typically permitted by most organizations and fall outside the scope of change request volume, as illustrated in Figure 3.  
Although PBSM demonstrates the capabilities of positive elements in operations, user experience, and administrative support, the model displays gaps in security and risk-reduction capabilities. Hosts within the same trust ring, in essence, have unrestricted access to communication regardless of whether it is desired or undesired. No defense barrier segment exists in a PBSM that segments the host at the micro level. The only defense barrier at this level is host-based. IEEE developed and published the 802.1x-2020 supported standard in 2020 that activated access-based control capabilities at the switch port level (e.g., the immediate layer above the endpoint/system) [16]. Network Access Control (NAC) is the solution developed by IT vendors to leverage an automated product that would enforce an authentication process to identify a connecting host and apply the proper permissions. The NAC solution, however, is limited in scope to LAN and WLAN on-premises network segments and deployed on a per Virtual Local Area Network (VLAN) basis. Most deployments utilize a clientless deployment option that leverages the 802.1X protocol, enabling an authentication service at the switch port or access point level. NAC enables a micro-segmentation capability within the PBSM architecture but is less optimal to scale for Enterprise-of-Things (EoT) and is cumbersome to maintain [17].