Software mashups will increasingly be used to develop commercial products, but securing the transactions will require new ways of identifying and managing the risks, said John Sluiter, Managing Security Architect at Capgemini.

Mashups don't require specialist technical knowledge to build, and will typically use some software components from outside an organisation. This means that people with creative ideas can build products to exploit new business opportunities, but also brings important trust and security worries, said Sluiter.

“The business model involves a degree of loss of control of the interaction with the customer, loose coupling between the sources of data - so that trust has to be established on the fly - and there is likely to be a highly varying risk profile among customers.” he explained.

A multi-level trust model is a key part of the response for developers of commercial mashups, Sluiter suggested. The model must support transactions such that a high risk customer required to pay a deposit in order to access a service, while a low risk one is offered loyalty points, for example.

“It used to be said that on the internet no-one knows that you are a dog,” Sluiter said. ID assurance must play a central role in commercial mashups, ranging from absolute forms of ID that prove who a person is, to relevant biographical details and drawing on contextual information such as the communities a person belongs to. Trust brokers such as the companies that run credit checks on individuals will be important partners in reducing the risks inherent in commercial mashups, he said.

Overall, the principles formulated by the Jericho Forum are useful guide, said Sluiter. A key theme of the Jericho principles is managing security risks without stifling innovation. To fully exploit the business benefits of mashups, companies should consider a more dynamic approach to security, with risk managers working in close partnership with mashup developers.