Mashup security requires dynamic approach

Software mashups will increasingly be used to develop commercial products, but securing the transactions will require new ways of identifying and managing the risks.

That prediction came this week from John Sluiter, managing security architect, Capgemini, in a presentation at the RSA Europe conference.

Mashups don't require specialist technical knowledge to build and typically use some software components from outside an organisation. This means that people with creative ideas can build products to exploit new business opportunities, but this also brings important trust and security worries, said Sluiter.

“The business model involves a degree of loss of control of the interaction with the customer, loose coupling between the sources of data, so that trust has to be established on the fly -- and there is likely to be a highly varying risk profile among customers,” he said.

A multilevel trust model is a key part of the response for developers of commercial mashups, Sluiter said. The model could support transactions on a pay basis, so that a high-risk customer is required to pay a deposit to access a service, and a low risk one is offered loyalty points, for example.

“It used to be said that on the internet no one knows that you are a dog,” Sluiter said.

ID assurance must play a central role in commercial mashups, ranging from absolute forms of ID that prove who a person is to relevant biographical details or drawing on contextual information, such as the communities a person belongs to.

Trust brokers such as the companies that run credit checks on individuals will be important partners in reducing the risks inherent in commercial mashups, he said.

Sluiter cited the Jericho Forum, saying that overall, its principles are useful guides. One key theme of the group's principles is managing security risks without stifling innovation.

To fully exploit the business benefits of mashups, companies should consider a more dynamic approach to security, with risk managers working in close partnership with mashup developers.

See original article on scmagazineus.com