That’s the method preferred by the folks at SquareTrade, who sell insurance for all manner of electronics.

As they have done with past Apple gear, they went out, bought the latest iPhone and dropped it until its screen was a cracked mess. This time, though, they compared it with Samsung’s Galaxy S II — probably the nearest competitor saleswise to the iPhone when it comes to the leading smartphones.

In this test, which was limited to dropping one phone apiece, the Galaxy S II fared considerably better, surviving both a shoulder-height drop and a face-down fall. The iPhone, meanwhile, got considerable damage even in a waist-high drop and saw its screen thoroughly wrecked when dropped face down onto concrete.

While the tests are clearly designed as a push for insurance for those 4 million new iPhone owners, they also make the case for a nice protective holder for the Siri-packing smartphones.

Earlier this year, it started selling discounted hotel rooms, and today it is announcing that it will offer deals on auto and home insurance.

The online retailer is now focused on four main categories: Shopping — which includes everything from books to clothing and home and garden — discounted cars, vacations and now insurance.

In March, O.co entered travel by hiring its own dedicated sales team. This time it’s partnering with Answer Financial, which is one of the largest auto and home insurance agencies in the U.S., in order to offer insurance.

O.co said consumers will be able to compare quotes from as many as 20 insurance providers and will be able to save an average of $468 a year on auto policies.

While other insurance sites offer to compare rates, O.co’s CEO Patrick Byrne said you can’t trust the companies to show rates lower than their own.

“This is a niche that I don’t think has been done by any large shopping site,” he said.

In January, it introduced the domain name O.co, which initially served as a shortcut to its regular Web site. During an introductory period, customers who shopped at O.co received free shipping.

Byrne said the reason behind the name is to have a more recognizable brand across the 90 countries in which it operates. The plan was for the domain name to change permanently internationally, and only to experiment with the shortcut domestically.

Now, it intends to accelerate the shift from Overstock.com to O.co in the U.S. as well.

“We saw more of a pick-up than we had anticipated. Today, a significant portion of our business is finding us from O.co,” he said.

Byrne expects to launch one more category in the next couple of months.

It’s as though this week was tailor-made for Bartkiewicz (pictured), who argues that companies in the cloud business–and their customers, too–are in denial about risk. And by risk I mean not the technological possibility that a service may fail to work as advertised, but in the financial liability sense.

In Amazon’s case, there’s not been any real discussion of financial liability. Even though several companies effectively had to pause operations during the period of its outage last week, the only compensation they seem to be getting, at least for the moment, is a credit on their bill for the time that affected systems were offline and an apology. Apologies and billing credits won’t work for large companies. In a case like that, someone, somewhere has to be on the hook financially in the case of failure.

Handing your data over to someone is in a way comparable to handing goods over to a shipping company who promises to get it safely from one place to the other. Something bad can happen along the way, and often does. Trains derail, ships sink or get attacked by pirates. This is why the insurance industry exists. Yes, data is slightly different because it can be copied, but you get the idea.

Anyway, as if on cue, I found in my in-box today a report from Bartkiewicz’s company, CyberFactors, which specializes in risk analysis related to cloud services. It made for very interesting reading: It has estimated the financial costs associated with the Epsilon breach, and the findings should get your attention. The security breach and release of customer data at the email marketing provider has exposed the company to liabilities that could be as high as $225 million. According to CyberFactor’s research, as many as 75 other companies were involved and the total number of affected email addresses may be as high as 60 million.

Dealing with the repercussions of the breach–informing customers about it, making changes to marketing strategies, and so on–could eventually cost those at the affected companies, which included household names like Best Buy, J.P. Morgan Chase, Citibank, Walgreen’s and the Walt Disney Company, as much as $412 million, pushing the aggregate cost of the incident to $637 million. Think about that. The exposure of an email database could wind up costing more than half a billion dollars.

Yet even that isn’t the worst of it. Once you take into account down-the-line costs, such as fines, forensic audits, litigation and loss of business, the total cost could exceed $3 billion. Roughly half of the total costs to the affected companies will occur in the first year after the breach, and the rest will come in the second and third years. Security breaches have a way of costing long after the incident itself fades from the headlines. Cloud companies, CyberFactors argues, are going to have to start thinking more like banks, insurance companies and hedge funds. The cloud is going to have to grow up.

It hasn’t happened yet, but Drew Bartkiewicz read it and became rather taken by the idea–so much so that he registered the Web domain name cloudcatastrophe.com. Once a regional sales manager for Salesforce.com, he had already drunk deep of the Cloud Kool-Aid. By the time he registered the domain, though, he was working in the insurance industry underwriting insurance policies for technology companies as vice president for cyber and information security risks at The Hartford.

His unique job history has led him to start asking fundamental questions about cloud computing and its business models that should if nothing else give some potential cloud customers pause and nudge cloud service providers–as varied as Salesforce, Amazon Web Services, Microsoft Azure and the like–to think about something they rarely talk about: Risk.

Don’t confuse this with security. Talk to the executive of any cloud provider, as I did recently with Adam Selipsky of Amazon, and you quickly find out that cloud providers take security seriously and they mean it, because without it they’re out of business.

Rather, the question is this: If a cloud catastrophe happens–critical, financially valuable data is breached or exposed or destroyed on a large scale–who’s financially liable for the damage to the customer’s business? Is it the cloud provider, who agreed to manage the data on behalf of the customer? Or is cloud computing still a use-at-your-own-risk sort of thing? The answer is, there is no clear answer. Bartkiewicz thinks the cloud computing industry will have to start answering it, and soon.

Bartkiewicz recently launched a new company called CyberFactors that aims to do two things. First it evaluates cloud providers for the risk they assume based on the amount of data they manage. Second, the firm helps develop warranties that cloud providers can offer to their customers and cloud policies for insurers so that both sides of the cloud relationship can be prepared for the worst. I caught up with him last week after he spoke at the Cloud Connect conference in Santa Clara, CA.

NewEnterprise: In a nutshell, what do you think is wrong with the cloud computing business models that are so popular and winning over so many customers?

Bartkiewicz: I’m an old Salesforce guy, so I was a big believer in the cloud, and then I got involved underwriting technology risk for insurance companies. I started to see some very interesting patterns emerge. The cost of failure is going up. So are the number of data breaches, and so are the laws imposing regulation on companies that handle data. Cloud computing companies are not being required to address in their models the implied financial liabilities they have on their balance sheet.

So where’s the implied risk you’re talking about?

If you take 100,000 customers of cloud computing companies, each is going to value their data in very different ways. Some use the cloud merely to track sales leads, others use it for trade secrets. Still others have identifying information on their customers. If a cloud company were to wind up suffering a catastrophic breach it would be in the long-term position of arguing with the customer over the value of the data compromised. The end result is a tremendous off-balance sheet liability, and shareholders and analysts who follow these companies aren’t connecting the dots. They need to be asking tough questions about this.

So where do you come into the picture?

Right now the thinking among the cloud companies is that any problem created by technology can be solved by more technology. They talk a lot about security, and they’re serious, but this isn’t a security issue. There’s not an industry in the world that doesn’t disperse risk through the means of insurance. I don’t mean to suggest that the cloud companies need to get insurance. What I mean is that they need to make insurance easy to get and affordable for their customers.

Wouldn’t something like risk be covered in a service-level agreement?

Right now the norm is that cloud companies cap their indemnification at the value of the contract. So if you spend $10,000 a year on a cloud application, the maximum you can get in the case of a breach is $10,000. But the data in question could be worth many times that. The average cyber-incident in our models costs $4.5 million.

And what does Cyberfactors actually do?

It’s a risk quantification tool. Companies that have cyber risk on their books today, whether or not it’s in the cloud, can make better informed transactions with cloud companies. Companies who use cloud computing need to know who absorbs the cost to fail, given the cost to fail is going up. There is a record number of class action lawsuits over privacy breaches, and regulators are imposing a lot of costs that result from a breach that have to be absorbed. This is a global problem in terms of data liability. Second, we have a platform called Cloudinsure.com that tries to “mash” cloud computing with insurance. Cloud computing needs massive risk transfer in order to save itself from itself.

So what companies are you working with?

I can’t say, but I can say we’re working with two cloud companies right now to help them design warranties. We just launched the company. And if a cloud has too much risk, and the warranty approach doesn’t make sense, we can also design insurance policies and then bring in the insurance companies to help back it.

What do the cloud companies think of this? Have you taken the idea to them?

I brought this concept to a cloud company. When I told them they need to disperse their risk, they said it would slow down the sales cycle. It was quite telling because the number one growth pattern for companies right now is denial.

EHealth Inc., an online insurance broker, has won two new government contracts for insurance websites, and has established a separate unit to go after a share of the exchange business. Benefitfocus Inc., which makes software designed for enrolling employees and others in health plans, says it is in talks with nearly 20 states to run their exchanges. Xerox Corp.’s ACS unit is circulating a white paper to states to make its case for integrating exchanges into Medicaid systems the company already runs.

At stake is some $4 billion a year in revenue, according to an estimate by HealthConnect Systems, a tech company that aims to compete for the new business.

Read the rest of this post on the original site »

The company’s new ad, which runs on the Apple iAd platform, takes a slightly different tack from rich-media ads that rely on the gee-whiz factor of full-screen videos and games. Liberty Mutual’s ad is plenty flashy, for an insurance advertisement, with buttons to push and screens to shake. But the company is really hoping to draw people in by getting them to evaluate whether they’ve been responsible citizens, commit to doing “acts of kindness” and spread the message on Twitter.

The efforts show how important it is for people making ads on mobile devices to get users to actually interact with the ad–something that would make them more likely to remember the message and brand. Mobile ads “work really well when you have content that people can share pass along and engage with,” said Baba Shetty, chief media officer at Hill Holiday, the ad agency behind the Liberty Mutual campaign.

The hope for many in the mobile-ad industry is that ads will automatically be more personalized and interactive because they’re on a device that people literally have in their hands. “You’re going from a passive audience to holding a mobile device in your hand and shaking it,” Mr. Shetty said.

Read the rest of this post on the original site