# Using Financial Instruments to Transfer the Information Security Risks
## 6 Design Specifications for Information Security Derivatives  
Financial economists treat the real-world financial instruments as a combination of simpler, hypothetical financial instruments [80]. These hypothetical financial instruments are designed to pay \begin{table}
\begin{tabular}{l l} \hline \hline
**Cyber-Insurance Problems** & **Functional Requirements for ISD** \\ \hline \hline \multicolumn{2}{l}{Inefficient and Ineffective} & Efficient and Effective Risk Hedging \\ \hline \hline \multirow{2}{*}{Information Asymmetry} & Increased Information Elicitation and Aggregation \\  & Strong Manipulation Resistance \\ \hline \hline \multirow{2}{*}{Incomplete Markets} & Increase in Products (Variety) \\  & Scalability \\  & Rapid Implementation \\ \hline \hline \multicolumn{2}{l}{Lack of Liquidity} & Increased Liquidity \\ \hline \hline \multirow{2}{*}{High Transaction Cost} & Reduced Transaction Cost \\  & Increased Price Transparency \\ \hline \hline \multirow{2}{*}{Regulatory Capital Requirements} & Low Cost of Capital \\  & Reduced Risk to Market Operator \\ \hline \hline \multicolumn{2}{l}{High Settlement Cost} & Low Settlement and Clearing Cost \\ \hline \hline \multicolumn{2}{l}{High Counterparty Credit Risk} & Low Counterparty Credit Risk \\ \hline \hline \multicolumn{2}{l}{Lack of Data} & Increased Data Generation \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Mapping of Cyber-Insurance Problems and Requirements for Information Security Derivatives (ISD). a unit of currency to the trader or investor if a particular \"state\" (outcome) among a set of possible \"states\" (outcomes) occur. These set of states are exhaustive _i.e._, cover all possible outcomes and the chosen states are mutually exclusive. These financial instruments are designed to isolate and break-down complex risks into distinct states. The usefulness of these hypothetical instruments is that the returns from complicated financial products can be modeled as a linear combination of the returns of these hypothetical instruments. The traders or investors participating in the market where trading of such financial instruments takes place, can bet on the state of the product for which they may have some relevant information. Thus, a variety of such financial instruments can be traded in an ISPM to provide the fundamental building blocks for information aggregation, analysis of risks and their impact and to hedge the underlying risk. Information security derivatives would provide a financial protection to the hedgers against the negative impact of the underlying information security event. An application scenario of ISD is shown in Figure 5.  
The individuals or organizations exposed to an information security event risk would purchase a corresponding derivative with the said event being the underlying of the derivative contract. The market participants who are participating in the market to reduce their exposure to the negative impact of the occurrence of the underlying information security event are called hedgers. Apart from the individuals and organizations who are exposed to an information security risk, cyber-insurers are likely to be a major participant in ISD trading to transfer their risk to the capital market and thus enhance their insurance capacity. Traditionally, insurers purchase derivatives as a vehicle to re-insure their risk exposure. Participation in capital markets allows the insurers to adjust their risk position than with traditional reinsurance companies rapidly. Furthermore, insurers and re-insurers can also be a seller in the market. The sellers of the ISD would rely on their premiums exceeding their payouts. To achieve this, sellers write a large number of different derivatives on many low-correlated and probabilistically diverse types of information security events. This allows the sellers to hedge their risk of making a big payout on multiple high impact information security events at the same time. Furthermore, the more likely an event is to occur; higher will be the premium for the corresponding contract.