Is inadequate Access Control on civil and infrastructure sites worth the risk?