a$.$ Apply the following data to evaluate the time$-$based model of security for the XYZ Company. Does the XYZ Company satisfy the requirements of the time$-$based model of security? Why?

$$ Estimated time for intruder to successfully penetrate system $=25$ minutes

$$ Estimated time to detect an intrusion attempt and notify appropriate security staff $=5$ minutes in best$-$case scenario; $10$ minutes in worst$-$case

scenario

$$ Estimated time to analyze detected intrusion attempts and implement

corrective actions: best$-$case scenario $=6$ minutes; worst$-$case scenario. $=$

$20$ minutes

b$.$ Which of the following security investments would you recommend? Why? If you could do only one, which would you recommend? Why?

$$ Invest $$50,000$ to increase the estimated time to successfully penetrate the system by $10$ minutes

$$ Invest $$40,000$ to reduce the time to detect an intrusion attempt and notify appropriate security staff to $1$ minute in best$-$case scenario, $4$ minutes in worst$-$case scenario

$$ Invest $$60,000$ to reduce the time required to analyze detected intrusion attempts and implement corrective actions to $4$ minutes under the best$-$case scenario and $10$ minutes under the worst$-$case scenario