Time insertion functions as a way how to guarantee state-based security with respect to timing attacks are proposed and studied. As regards the security property, we work with the property called process opacity. First, we define timing attacks and later we show how security with respect to them can be enforced by such functions. The time insertion function can alter the time behaviour of the original system by inserting some time delays to guarantee its security. We investigate conditions under which such functions do exist and also some of their properties.