Time Dependencies Model

<h2>Time-Related Business Drivers</h2>

<ul>

<li>Business transaction turnaround times - The security architecture must support these. In particular security mechanisms must not slow down response times beyond business tolerances.</li>

<li>Business transaction lifetime - These affect the mechanisms that you apply to secure business transactions. The security mechanisms must have llifetimes exceeding those of the transactions that they secure with a tolerable margin of safety.</li>

<li>Business deadlines - For example, banking cut-offs and stock-market closing times may have an impact on how the security architecture is to be implemented. In particular the provision of secure time-stamps on certain types of business transactions may be a fraudprevention mechanism to detect attempts to manipulate business cut-offs. Perhaps the most extreme type of example would be placing a bet on a horse race after the race has finished and the result is known – there may be parallels in your business.</li>

<li>Record retention times - The security architecture needs to ensure that data can be retrieved and read and used right up to the end of the period, which is often a regulatory requirement. One of the main threats here is the withdrawal of support for old storage media technologies. You may have archived copies of electronic documents on old tapes or disks stored in a vault somwhere, but do you have the sub-systems to read these items? Consider the disappearance of 8-inch and 5-inch fl oppy diskette drives. </li>

<li>Response to customers - It must be within a time that they expect. This is another example of the need to ensure that security mechanisms and procedures do not delay the business responses beyond an allowable tolerance threshold. </li>

<li>Just-in-time operations - These are needed for manufacturing operations where stock levels are kept to an absolute minimum to maximise cash fl ow in the business. If the security mechanisms were to cause delays that meant JIT deadlines were missed, this would have a damaging effect on business continuity.</li>

<li>Time to market - This means balancing the risk of going to market with a product or service that may not be perfect in terms of its security against investing more time to get the security to an acceptable level whilst missing a business opportunity. Risk management is never easy, and mitigating one risk will always increase at least one other risk. Always be aware of the risk of doing something versus the risk of not doing it.</li>

</ul>