# Using Financial Instruments to Transfer the Information Security Risks
## 4 Problem Elicitation  
Currently, cyber-insurance products are the only financial instruments available in the market that facilitate transferring of information security risks to some extent. However, the cyber-insurance products come with various problems. An empirical analysis of insurability of cyber-risks is presented in [65], summarized in Table 4. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Insurability Criteria** & **Main Findings** & **Assessment** \\ \hline Randomness of Loss & - Correlation among risks hinders efficient pooling - Risk pools are too small and cannot be diversified; also, lack of adequate reinsurance - Lack of data - Changing nature of cyber risks (e.g., new standards, regulations) & Problematic \\ \hline Maximum Possible Loss & - Maximum possible loss for cyber risk lower than for other operational risks - Insurers protect against extreme loses by cover limits & Not Problematic \\ \hline Average Loss Per Event & - Average loss for cyber risk lower than for other operational risks - Dependent on company size, self-protection, and institutional commitment for information security & Not Problematic \\ \hline Loss Exposure & - Increasing number of cyber risk events - Dependent on event catgory (_i.e._, human actions dominate other event categories) & Not Problematic \\ \hline Information Asymmetry & - Moral hazard poses a strong theoretical threat; regular risk assessments, deductibles, and caps on coverage help reduce moral hazard - Adverse selection poses a strong theoretical threat; upfront risk assessments (screening) and signaling (e.g., ISO certificates) help reduce adverse selection & Problematic \\ \hline Insurance Premium & - High premiums and other costs due to large uncertainties; expected to decline - Large geographic and industry variations in availability of policies - Low number of competitors; expected to increase over time - Additional costs (e.g., upfront risk assessments) & Increasingly Less - Problematic \\ \hline Cover Limits & - Policies typically cover a maximum (e.g., US 50 Million) - Policies contain exclusions (e.g., self-inflicted loss, accessing unsecure websites, terrorism) - Indirect costs (e.g., reputational effects) cannot be measured and often not covered - Product complexity can be problematic (lots of exclusions, dynamic risk nature, both for the insurance seller and buyer uncertainty regarding the actual coverage) & \\ \hline Public Policy & - Increase in overall industry exposure through cyber insurance is conceivable due to moral hazard incentives and high loss correlations in interrelated networks - Insurance fraud might be incentivized, since hacking attacks or physical attacks are difficult to detect and to trace back & Less - Problematic \\ \hline Legal Restrictions & - In many countries it is not allowed to insure regulatory fines - Risk of change (e.g., new legal standards and regulations) - Complexity and dynamic nature of this novel risk type might pose a potential legal threat for insurance brokers that limits their willingness to offer the product; only few specialists willing and able to sell cyber insurance - Disclosure of sensitive information & Less - Problematic \\ \hline \hline \end{tabular}
\end{table} 
Table 4: An Assessment of Insurability of Cyber Risks (adapted from [65]). The problems in the existing cyber risk management market that are relevant to this article are discussed as follows:  
1. **Limited Efficiency and Effectiveness of Cyber-Insurance:** Cyber-insurance is the \"statistical\" approach to hedge the risks, and it relies on the law of large numbers. For the mechanism to work successfully, the risks covered must be reasonably independent to each other and the frequencies (estimation) must be known. All that is required for the success of insurance products is a reliable actuarial table, and a large pool of insureds to distribute the risk. However, unlike other insurance products, cyber-insurance products are designed in absence of proven actuarial tables.