# Cybersecurity Access Control: Framework Analysis in a Healthcare Institution
## 4 Discussion
### Capabilities, Risk, and Support
Remote connectivity (i.e., SSVPN) is out of the scope of an NAC solution and typically leverages a one-time multi-factor user-prompted authentication method. ZTA, which, according to the survey, has an adoption of 33% by respondents, shifts the deployment framework from a macro-segmentation application focusing on infrastructure-level solutions and instead places the deployment of solutions at the micro-segmentation level. Operating on the principle that no user or device on the network is inherently trusted, hosts are consistently challenged and monitored to ensure they are authorized and privileged to perform attempted actions or access [16]. NIST SP 800-207 outlines the ZTA with three core components, as shown in Figure 4: the Policy Engine (PE), the Policy Administrator (PA), and the Policy Enforcement Point (PEP). The Policy Decision Point comprises the PE and the PA. The PE is responsible for determining whether to grant or restrict access to resources based on policy and additional information from other integrated sources. The PE partners with the PA, which completes the PE's decision execution by signaling the command to the PEP. The PEP executes the command from the PA on the individual host and defense barrier (e.g., gateway) [18]. The PE utilizes policy-driven configuration values to determine the permissions eligible for a specific host. ZTA increases the level of granularity from PBSM to the utilization of additional security artifacts (i.e., IP address, username, MAC address, device ID, geographical location, etc.). The increased level of granularity over PBSM policies increases the risk of overhead associated with support elements and the implementation and development of these policies. PEP introduces a client to the critical path, requiring all endpoints to have a client or agent installed on the host system. Survey results reported a range of three to seventeen daily support engagements with an average of ten daily and an average of nine after-hours engagements. During 2023, Company X, operating under a PBSM with a remote access solution that employs a client, experienced an average of four monthly support  
Figure 3: Company X 2023 access change requests (Firewall, VPN, ACLs). engagements concerning the remote access client, with approximately 4000 users connecting to the organization daily on average. See Figure 5.  
At the time of this report, Company X boasted an employee population of 44,000, which is 11 times larger than the number of remote/client-based users. Based on these figures, projections suggest that under the ZTA, Company X's support engagements will surge to 11 times the current volume. This translates to an anticipated average increase of 44 monthly support engagements, adding to the existing 336 support engagements reported by Company X, bringing the total to 380 support engagements monthly under the ZTA model. As illustrated in Table 1, there are notable increases in delta values from PBSM to ZTA for daily support tickets and weekly after-hours engagements, highlighting the significant difference in user impact and support overhead between the two approaches. \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & **Daily Support Tickets** & **Daily Hours** &
\begin{tabular}{c} **Weekly after-Hours** \\ **Engagements** \\ \end{tabular} & **Monthly** \\ \hline PBSM & 10 & 6.67 & 3.33 & 336 \\ \hline ZTA & 17 & 5.5 & 9 & 380 \\ \hline \%\(\Delta\) & 70 & \(-\)18 & 170 & 13 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: PBSM and ZTA compared support metrics. Figure 4: ZTA core components.