# Using Financial Instruments to Transfer the Information Security Risks
## 6 Design Specifications for Information Security Derivatives
### ISD Design Process
#### 6.2.5 Payout Trigger  
In general, structuring an information security hedge would comprise of two components: the selection of the trigger (index) and the payoff structure for the given index. Particularly, the hedge effectiveness of information security derivatives would depend on the quality of the index in predicting losses and on the factors, such as trigger, tick size, and cap, defining the payout function. Thus, the challenge is to develop an index that meets the needs of the market participants. Ideally, the index should be easily understandable, easy to calculate, and based on verifiable data. In other words, the index should be transparent. Furthermore, the index must be calculated and settled within the shortest span of time if the underlying event occurs. Designing a suitable information security risk index involves identification of source of the risk that the derivative contract is intended to hedge. The objective is to create information security risk indices that posses a high correlation with the risk event as this would affect the hedge effectiveness. The index must posses a high correlation with the financial impact of the information security event to be hedged. This is required to minimize the basis risk. An imperfect correlation of the index and financial impact of risk event may lead to inadequate hedging of risk impact. An objective, consistent, transparent and rule-based computational index for information security risks can be designed in the same manner as the index for weather derivatives and stock market indices for macroeconomic models represent the market risk exposure correlation to other enterprise risks [85]. The information security risk index can be created from the data patterns of the organization's Cyber-Value-at-Risk (Cyber-VaR) models [83] paired with the historical information, such as type of security event, frequency, loss and so on, to predict the probability and financial impact of the corresponding information security event. Furthermore, the historical information about the security event may include intra-organizational as well as industry wide information. The information security risk index can then be used as a threshold to trigger the derivatives payout. The Gumbel's method of exceedances [86] can be useful in predicting the number of future information security events or incidents (values) that would exceed the past values. The Gumbel method assumes that a hypergeometric stochastic process is followed for the frequency of events as expressed in Equation (20). \[P_{r}(H=j)=\frac{\left( \begin{array}{c}r+n-\tau+j\\ n-\tau\end{array} \right)\left( \begin{array}{c}j+\tau-1\\ \tau-1\end{array} \right)}{\left( \begin{array}{c}\frac{r+n}{n}\\ \end{array} \right)} \tag{20}\]  
\[\text{where }j=0,1,2,3,...,r\]  
where, \(\tau\) is the threshold (index strike), \(n\) is the total number of (information security) events, \(j\) is the total number of events above the threshold, and \(r\) is the number of future observations, \(\text{X}_{n+1}\),..., \(\text{X}_{n+r}\)_i.e._, number of periods it would go ahead. Therefore, we can express the number of exceedances of \(X_{\tau,n}\) among the next \(r\) observations, \(X_{n+1}\),..., \(X_{n+r}\), as in Equation (21). \[H_{r}^{n}(\tau)=\sum_{i=1}^{r}I_{(X_{n+i})>X_{\tau,n}} \tag{21}\]  
Let us say, the total (successful and unsuccessful) number of vulnerability exploitation in a particular smart grid system in the last one year stands at 31. Now, we need to know the probability of an event which is higher than the threshold and that would not happen in the next year. For this case, we consider the threshold as the event with highest impact. Therefore, for the software vulnerability exploitation in the given smart grid we have \(n=31\) (number of events recorded in the last one year), \(r=1\) (one year ahead), \(\tau=1\) (number of highest impact event as threshold), and \(j=0\) (number of events above the threshold, _i.e._, the events with an impact higher than the impact of the event chosen as threshold).