7 place. Now two questions must be asked--how much time does it take to steal the information and how much is the stolen information worth? Assume there is a total denial of service for 9 minutes. The answer is that the brokerage entity would be out of business.

Moreover, the more distributed a network is, the more vulnerable it is to interception and unauthorized access. Take for example, the system in Diagram A. This system exhibits four inherent weaknesses in its architecture: 1) The wireless trading pad running the “Epit application” can be hijacked by a Trojan horse or spyware can be inserted into the communication while in transit from its point of origin to its destination. 2) The Wireless Server/Access point is an easy entry point. 3) The NYME WLAN is susceptible to rogue access points and devices unless frequent audits are conducted for such intruders and 4) The end customer is using the Internet to communicate desired trades into this “secure system” the Internet and those applications that are permitted to move through the firewall have been polluted.<sup>10</sup> There are ways to mitigate most of these operational risks. Application security, active content filtering, security for pervasive or diffuse computing and grid computing will be critical as will real-time configuration management. The widespread adoption of wireless local area networks (WIFI) are but one example of the convergence of modern telecommunications and IT systems which become open to interception. The popularity of wireless systems (both satellite and terrestrial wireless) has continued to increase. This spread of the technology often coupled with the lack of implementation of certain safeguards for systems<sup>11</sup> , creates a serious risk, making wireless systems inherently vulnerable to being breached. Although _Straight Through Processing_ (STP) coupled with XML and T + O appears to provide optimal efficiency, if fraud is committed there is no recourse in the settlement window. Unwinding is impossible in the traditional sense in a T + O environment. Today’s settlement paradigm and its safeguards should be reviewed as the goal to operate in a T + 0 environment redistributes the risk of disputes about settlement to after the fact rather than trying to resolve such prior to settlement. By redistributing risk, the very nature of the contract changes and this in turn should impact cost and price calculations.

The issues posed by these innovations are not just the result of architecture and configuration but also result from how today’s market defines efficiency and effectiveness. Inherently the securities market is different than banking. In banking, safety and soundness are primary, but securities is about assuring that investors are aware of and understands the investment risk. Now the question is whether the investor is adequately educated about the operational risk of the vehicle used to place the trade not just the market risk of the underlying security being traded. Arguably in the securities market if an investor knowingly chooses to use a riskier means of trading that’s acceptable, the question then is whether the broker or trader has adequately advised

> 10 Although applications are being developed according to common criteria e.g. www.wapforum.org .  Many security gaps exist in both the procedural areas and technical areas if implementation per secure wireless networking.

> 11 For best practice per securing WLANs, GSM, GPRS and GPS please refer to the Technology Risk Checklis t. World Bank. October  2004.