# Using Financial Instruments to Transfer the Information Security Risks
## 7 Demonstration: An Example Application
### Information Security Vanilla Options
#### 7.2.4 Risk Hedging  
To demonstrate the application of ISVO, we consider only three states of the risk event in the given scenario. The three states are as follows:  
* \(S_{1}=C\) does not suffers a cyber-attack in the trading period or its services are not adversely affected if attacked. * \(S_{2}=C\) suffers a cyber-attack and its services are unavailable for 1 h.
* \(S_{3}=C\) suffers a cyber-attack and its services are unavailable for 3 h.  
(1) Risk Analysis and Impact Estimation  
We assume that the company \"C\" has completed its risk analysis and impact assessment. The company's estimate based on the CVaR model is as, probability of no cyber-attack or no adverse impact is 50%, probability of service unavailability for one hour due to a cyber-attack as 30%, and probability of service unavailability for three hours due to a cyber-attack as 20%. Furthermore, if \(S_{1}\) occurs there is no loss to the company \"C\". If \(S_{2}\) occurs the company may lose $10,000, as estimated by it. If \(S_{3}\) occurs the company may lose $30,000. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Participant** & **Trading Side** & **Incentive/Motivation** \\ \hline Company “C” & Buy & To hedge the risk exposure. \\ \hline Cyber-security vendor’s of “C” & Bell & To convince others through the display of strong faith that their products are of high quality and can strongly defend against cyber-attacks. \\ \hline Competitors of security product vendors of “C” & Buy & To convince others through the display of strong signal that the products of cloud service provider’s are not strong enough and can not defend against the advance cyber-attacks. \\ \hline Investors in “C” & Buy/Sell & To hedge their risk or to profit from trading in the contract. The buy or sell decision depends on investor’s individual belief. \\ \hline Cyber-Insurer and Cyber-Reinsurer & Buy/Sell & To hedge their risk or to profit from trading in the contract. The buy or sell decision is based on the company’s risk portfolio. \\ \hline Speculators & Buy/Sell & This category includes a range of market participants, such as speculators, hedge funds, proprietary trading firms, individual traders, and so on. These traders participate (buy or sell) to earn a profit from the relevant information they may have. \\ \hline Security Researchers & Buy/Sell & Security researchers in possession of some relevant information may participate in the trading of the contract. \\ \hline \hline \end{tabular}
\end{table} 
Table 13: Participants and Incentives for ISVO. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt}} \hline \hline
**Fixed Specifications** & **Variable Specifications** \\ \hline Know Your Trader/Investor Required & Yes \\ \hline Transferable Instrument & Yes, to other verified traders only \\ \hline Other Relevant Information & Nil \\ \hline \hline \end{tabular}
\end{table} 
Table 12: _Cont._(2) Risk Response  
In the given scenario, the cloud service provider may choose to hedge the risk by purchasing ISVO contracts. The buyer can buy an ISVO contract at $30 per option and the contract pays $100 per contract for each one hour of service unavailability and pays nothing if the company's services are not adversely affected by a cyber-attack. The current market price for the three states of the ISVO indicate that the market estimates the probability of no cyber-attack or no adverse impact of the attack as 60%, unavailability of the services for one hour as 30%, and unavailability of services for three hours as 10%. (2.1) Unhedged Scenario  
Based on the market's probability estimate for the three states, the expected future value for the company in an unhedged scenario can be calculated as shown in Equation (39).