# Using Financial Instruments to Transfer the Information Security Risks
## 7 Demonstration: An Example Application
### Information Security Swaps
#### 7.3.4 Risk Hedging  
In the given scenario, the ISS is designed to let the satellite communication company transfer its risk to the counterparties who are willing to take the risk in the expectation of earning some profit. The counterparty in this case is a group of several entities, each with a limited potential liability. In the given scenario, there are two types of risk events, namely service unavailability for a limited period and hijacking of the satellite leading to permanent loss of the same. Thus, the possible states of the events are as shown in Table 16.  
The state \(S_{I}\) occurs when there is no cyber-attack or no service disruption. \(S_{2}\) occurs when a cyber-attack occurs and the satellite services are temporarily disrupted but the satellite system is not hijacked. \(S_{3}\) occurs when there is no temporary service disruption but the satellite system is hijacked leading to permanent loss. \(S_{4}\) occurs when the cyber-attack causes temporary service disruption before the system is hijacked leading to permanent loss. (1) Risk Analysis and Impact Estimation  
We assume that these \"state\" risks have been modeled and the outcome of the CVaR model for the company is as shown in Table 17.  
On the other hand, the counterparty's (seller's) estimate the risk probability and impact as shown in Table 18. \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Limited Period Interruption** & **Satellite Hijacking (Permanent Loss)** \\ \hline \(S_{1}\) & ✗ & ✗ \\ \hline \(S_{2}\) & ✓ & ✗ \\ \hline \(S_{3}\) & ✗ & ✓ \\ \hline \(S_{4}\) & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 16: Possible States of Events for the ISS Contract. \begin{table}
\begin{tabular}{c c c} \hline \hline
**State** & **Loss Probability** & **Impact Value** \\ \hline \(S_{1}\) & 60\% & \$0 \\ \hline \(S_{2}\) & 25\% & \(-\$150,000\) \\ \hline \(S_{3}\) & 10\% & \(-\$350,000\) \\ \hline \(S_{4}\) & 5\% & \(-\$500,000\) \\ \hline \hline \end{tabular}
\end{table} 
Table 17: Outcome of CVaR Model on Event Probabilities and Impact. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Participant** & **Trading Side** & **Incentive/Motivation** \\ \hline Company “\(S\)” & Buy & To hedge the risk exposure. \\ \hline Security Product & Sell & To convince others that their products are of high quality and \\ Vendors of “\(S\)” & & can strongly defend against cyber-attacks. \\ \hline Cyber-Insurer and & Sell & To hedge the risk exposure due to new developments in the \\ Cyber-Reinsurers & & company/technology/regulatory requirements, _etc._ To diversify \\  & & their investment and profit from trading in the contract, if they \\  & & believe that the company “\(S\)” has strong security system. \\ \hline Speculators & Sell & To diversify their investment portfolio. \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Participants and Incentives for Information Security Swaps (ISS). (2) Risk Response  
In the given scenario, the satellite services provider may chose to hedge the risk by purchasing a swap contract. The swap contract is structured such that the counterparty would pay the amount of loss, or $500,000, whichever is lower. If the state \(S_{1}\) occurs, then no payout is required from the seller (counterparties) to the buyer (satellite services company). However, if any of the state \(S_{2}\), \(S_{3}\), \(S_{4}\) occur then the counterparty would pay a fixed amount to the buyer. The satellite services provider is required to pay a premium of 2% of the maximum possible payout ($500,000) to the counterparties. This premium is paid at the time of ISS purchase. (2.1) Unhedged Scenario  
In an unhedged scenario, the company's expected future value can be calculated as shown in Equation (51).