Security access control effectiveness design

Abstract

South Africa's infrastructure faces a barrage of security attacks that has led to the promulgation of the Critical Infrastructure Protection Act (CIPA) No. 8 of 2019. Residual risk (i.e. after the threats have been mitigated) must be assessed for the critical infrastructure security system as part of the total security system design. One area that requires attention is access control. This paper will demonstrate how to approach such a design with particular focus on the effectiveness of the access control system and how to choose the biometric or digital key (such as access cards) system. The approach starts with defining access control events which are used to define access control effectiveness in terms of probability of invalid access and probability of anomaly detection. The theoretically derived results are validated by means of simulation. Based on these models, guidance is provided for the design of access control for critical infrastructure.