Mashup security requires dynamic approach

By

Software mashups will increasingly be used to develop commercial products, but securing the transactions will require new ways of identifying and managing the risks.


Software mashups will increasingly be used to develop commercial products, but securing the transactions will require new ways of identifying and managing the risks.

That prediction came this week from John Sluiter, managing security architect, Capgemini, in a presentation at the RSA Europe conference.

Mashups don't require specialist technical knowledge to build and typically use some software components from outside an organisation. This means that people with creative ideas can build products to exploit new business opportunities, but this also brings important trust and security worries, said Sluiter.

“The business model involves a degree of loss of control of the interaction with the customer, loose coupling between the sources of data, so that trust has to be established on the fly -- and there is likely to be a highly varying risk profile among customers,” he said.

A multilevel trust model is a key part of the response for developers of commercial mashups, Sluiter said. The model could support transactions on a pay basis, so that a high-risk customer is required to pay a deposit to access a service, and a low risk one is offered loyalty points, for example.

“It used to be said that on the internet no one knows that you are a dog,” Sluiter said.

ID assurance must play a central role in commercial mashups, ranging from absolute forms of ID that prove who a person is to relevant biographical details or drawing on contextual information, such as the communities a person belongs to.

Trust brokers such as the companies that run credit checks on individuals will be important partners in reducing the risks inherent in commercial mashups, he said.

Sluiter cited the Jericho Forum, saying that overall, its principles are useful guides. One key theme of the group's principles is managing security risks without stifling innovation.

To fully exploit the business benefits of mashups, companies should consider a more dynamic approach to security, with risk managers working in close partnership with mashup developers.

See original article on scmagazineus.com
Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Victoria's Secret pulls down website amid security incident

Victoria's Secret pulls down website amid security incident

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?