Apply the following data to evaluate the time$-$based model of security for the XYZ Company.

Estimated time for attacker to successfully penetrate system $=25$ minutes

Estimated time to detect an attack in progress and notify appropriate information security staff $=5$ minutes $($best case$)$ to $10$ minutes $($worst case$)$

Estimated time to implement corrective actions $=6$ minutes $($best case$)$ to $20$ minutes $($worst case$)$

Time$-$Base Model

Best Case Scenario P is greater than

Worst Case Scenario $P$ is less than

P

D $($Best Case$)$

$C($Best Case$)$

D $($Worst Case$)$