# Using Financial Instruments to Transfer the Information Security Risks
## 1 Introduction  
In today's hyper-connected world, currently cyber-insurance products are the only way of handling the residual information security risks. Recent incidents of cyber-attacks on various organizations [1] prove that even the most sophisticated technical defense systems are not sufficient to mitigate the residual (adverse financial) impact of cyber-security events. Thus, cyber-insurance products provide an opportunity to individuals and organizations to spread their risks. This ensures that no single entity receives a financial burden that is too large for it to bear. However, cyber-insurance markets are susceptible to information asymmetry between buyers and insurers, and between insurers and re-insurers; thus raising the cost of the transaction and inhibits transparency. Furthermore, due to interdependent and correlated nature of information security risks, the uncertainty about the quantum of risk exposure leads to the fear of systemic and huge losses for cyber-(re)insurance providers. This difficulty in quantifying the information security risks leads to underestimation of future losses, thus cyber-(re)insurance providers are incapable in underwriting the catastrophic impact of cyber risks [2]. Thus, in absence of adequate market mechanisms for risk acceptance, the interest of information security stakeholders who wish to transfer their risks and those who are willing to accept the risk are reduced. Furthermore, the World Economic Forum in its annual risk report stated that \"A critical element in advancing this (on cyber risk management) discussion will be _improving the collective ability to measure the economic impact of cyber risks_, at all levels--within individualbusinesses, nationally and globally. _Effective methods for measuring and pricing cyber risks may even lead to new market-based risk management structures_, which would help in understanding the systemic inter-dependencies in the multiple domains that now depend on cyberspace\" [3]. In theory, capital markets can be an effective mechanism to undertake a high impact and correlated information security risks. Capital market-based financial instruments can be developed as a risk transfer mechanism with the ability to absorb the risk of catastrophes and their potential to add liquidity and transparency to the risk transfer market [4; 5; 6; 7; 8; 9]. Thus, the task of creating an information security risk market for risk transfer (hedging) faces two key challenges. The first is to design the market where various information security related financial instruments can be traded, and, second, the specification of financial instruments (derivatives/contracts) to address various information security risks. This article deals with the second problem, _i.e._, the specification of information security derivatives to allow hedging of risk exposure to the underlying information security event. The first challenge of designing an Information Security Prediction Market (ISPM) to allow the trading of such financial instruments has been addressed in [10; 11; 12]. The primary goal of a prediction market is to elicit and aggregate information about the trading contracts' underlying events. Like other prediction markets, ISPM will allow traders to express their probability assessment for the possible outcome(s) of the underlying event. This is achieved by the trading of financial instruments (contracts), and the traders with more accurate predictions than others are compensated for the same. Thus, the participants have an economic incentive to improve the market accuracy by revealing any relevant information they may have. Therefore, in addition to the goal of achieving information elicitation and information aggregation, financial instruments trading at ISPM can be used as a mechanism for measuring and pricing of cyber risks and as a mechanism to transfer/hedge the underlying cyber (information) security risks.