Software
mashups will increasingly be used to develop commercial products, but
securing the transactions will require new ways of identifying and
managing the risks, said John Sluiter, Managing Security Architect at
Capgemini.
Mashups don't require specialist
technical knowledge to build, and will typically use some software
components from outside an organisation. This means that people with
creative ideas can build products to exploit new business
opportunities, but also brings important trust and security worries,
said Sluiter.
“The business model involves a degree
of loss of control of the interaction with the customer, loose
coupling between the sources of data - so that trust has to be
established on the fly - and there is likely to be a highly varying
risk profile among customers.” he explained.
A multi-level trust model is a key part
of the response for developers of commercial mashups, Sluiter
suggested. The model must support transactions such that a high risk
customer required to pay a deposit in order to access a service,
while a low risk one is offered loyalty points, for example.
“It used to be said that on the
internet no-one knows that you are a dog,” Sluiter said. ID
assurance must play a central role in commercial mashups, ranging
from absolute forms of ID that prove who a person is, to relevant
biographical details and drawing on contextual information such as
the communities a person belongs to. Trust brokers such as the
companies that run credit checks on individuals will be important
partners in reducing the risks inherent in commercial mashups, he
said.
Overall, the principles formulated by
the Jericho Forum are useful guide, said Sluiter. A key theme of the
Jericho principles is managing security risks without stifling
innovation. To fully exploit the business benefits of mashups,
companies should consider a more dynamic approach to security, with
risk managers working in close partnership with mashup developers.