Summary

D1.1 Initial MUSA Framework Specification

This deliverable presents the initial version of the overall MUSA framework architecture, including the intended usage scenarios, along with the derived project requirements that will guide the MUSA research and implementation work. The deliverable is born from the collaboration of all project participants and it serves as a common project reference across all the technical work packages. The deliverable contains also a glossary that defines the main concepts handled in the project. Both the architecture and glossary are evolving descriptions that will be kept updated to ensure the alignment with the actual implementation of the framework.

D1.2 Guide to security management in multi-cloud applications lifecycle

This is a guide to security management in multi-cloud applications lifecycle. It is a first draft of best practices and guidelines to multi-cloud application developers and operators. It describes the MUSA framework’s impact on integrated and holistic management of application security across the whole life cycle. There are descriptions of MUSA activities, how they relate to a case study example, what is meant by multi-cloud security and an initial lifecycle description and its relationship to MUSA framework.

D1.3 Initial MUSA framework implementation

This deliverable presents the initial version of the MUSA Framework including the result of the continuous integration of the MUSA tools developed in WP2, WP3 and WP4. It describes the integration between the MUSA tools and presents the outcomes resulting from the whole MUSA Framework implementation. In order to address the integration of the MUSA tools, the project has considered the agile nature of the multi-cloud application development approach promoted by MUSA as well as the multi-disciplinary DevOps team being the main user of the MUSA Framework. Therefore, the project has implemented a centralized binding mechanism (MUSA Dashboard) that handles the interactions between the MUSA tools and presents the MUSA Framework as a unified solution. In addition, the document describes the MUSA Framework infrastructure required for the deployment of the MUSA tools. The deliverable is accompanied by the initial version of the tool prototypes integrating the MUSA framework, including the MUSA Dashboard, which are already available in project repositories.

D1.4 Final MUSA framework specification and guide

This deliverable presents the final version of the overall MUSA framework architecture, including the intended usage scenarios, along with the derived final project requirements that have guided the MUSA research and implementation work. The deliverable has followed an iterative approach with the collaboration of all project participants and it serves as a common project reference across all the technical work packages. The deliverable contains also a glossary that defines the main concepts handled in the project. The final version is fully aligned with the more detailed descriptions about design and implementation of the components of the MUSA framework (technical deliverables in WP2, WP3 and WP4). This deliverable also describes the final version of the guide to security management in multi-cloud applications lifecycle provided by MUSA. It describes the MUSA framework’s impact on integrated and holistic management of application security across the whole life cycle.

D1.5 Final MUSA framework implementation

This deliverable presents the final version of the MUSA Framework reflecting the result of the continuous integration of the MUSA tools developed in WP2, WP3 and WP4. It describes the integration between the MUSA tools and presents the outcomes resulting from the whole MUSA Framework implementation. In order to address the integration of the MUSA tools, the project has considered the agile nature of the multi-cloud application development approach promoted by MUSA as well as the multidisciplinary DevOps Team being the main user of the MUSA Framework. Therefore, the project has implemented a centralized binding mechanism (MUSA Dashboard) that handles the interactions between the MUSA tools and presents the MUSA Framework as a unified solution to the users. In addition, the document describes the MUSA Framework infrastructure required for the deployment of the MUSA tools. The deliverable is accompanied by the compiling of the references to the final version of the tool prototypes integrating the MUSA Framework, which are available in public repositories.

D2.1 Initial SbD methods for multi-cloud applications

This deliverable includes the initial description of the mechanisms and tools that MUSA offers to define the security constraints of a multi-cloud application, in order to support a security-by-design (SbD) development process. Since the adopted SbD approach is based on Security SLAs as a means to express the security requirements of a multi-cloud application and of each of its components, the deliverable provides a discussion of the Security SLA model adopted in MUSA and illustrates the SLA Generation process, aimed at building components’ Security SLAs. In order to support this process, the document introduces an SLA Generation proof-of-concept application, which applies a risk categorization and assessment procedure to each component and uses state-of-art Security Control Frameworks for the identification of their security requirements.

D2.2 Initial MUSA IDE for security-aware design of multi-cloud applications

This deliverable presents the initial version of the MUSA IDE for the security-aware design of multicloud applications. More particularly, the document describes the MUSA Modeller which supports the modelling of multi-cloud applications taking into account their security concerns. The MUSA Modeller enables: (a) the multi-cloud secure application components design and (b) embedding the security needs inside the application software following a non-intrusive approach. The document is the technical report that accompanies the actual initial software prototype of the MUSA IDE that has been designed and developed following the architecture and implementation described herein. Note that the initial version of the MUSA SLA Generator that supports the SLA specification and composition of security requirements together with functional needs was already described in deliverable D2.1.

D2.3 Final SbD methods for multi-cloud applications

This deliverable includes the final description of the methodologies, mechanisms and tools that MUSA offers to design a secure multi-cloud application, following a security-by-design (SbD) development process. The proposed approach is based on the adoption of Security Service Level Agreements (SLAs) that are used in the full development life cycle in order to gather security requirements, model the needed security controls and assess the security level that the application can really grant after the deployment in a multi-cloud environment. In the document we describe in detail the MUSA SLA-based Security-by-DEsign (MUSA SSDE) approach and how it can be applied in different development methodologies (including the agile ones) and how it has been integrated in the MUSA workflow and how it is based on two mechanisms, namely the SLA generation and SLA composition. Finally, the document presents the SLA generator and composition tools that can be used as a stand-alone application or fully integrated in the MUSA framework.

D2.4 Final MUSA IDE for security-aware design of multi-cloud applications

This deliverable presents the final version of the MUSA Modeller solution which supports the modelling of multi-cloud applications taking into account their security concerns. The MUSA Modeller enables: (a) the multi-cloud secure application components design and (b) declaring MUSA security agents to use with the application components. The document is the technical report that accompanies the final software prototype of the MUSA Modeller that has been designed and developed following the architecture and implementation described herein. Note that the final version of the MUSA Dashboard for the integrated MUSA Framework is described in deliverable D1.4 Final MUSA framework specification and guide, and the final version of the SLA Generator that supports the Security SLA specification and composition is described in deliverable D2.3 Final SbD methods for multi-cloud applications.

D3.1 Initial security based discovery and composition mechanisms and tools

The deliverable D3.1 Initial security based discovery and composition mechanisms and tools of MUSA project has two components: the first is a working prototype that can be reviewed and evaluated online, while the second component is this document. This technical specification report describes the first prototype service discovery and composition software that is delivered as part of Work Package 3. This report details some of the discussions that led to change from the initial description of work and the innovation developed as part of this work package. Risk management, data acquisition and service selection approach in MUSA are described in detail and references to the user guide (video) and repository of the accompanying software prototype are provided.

D3.2 Initial secure multi-cloud deployment mechanisms and tools

This deliverable includes the initial technical specification of the mechanisms and tools that MUSA offers to support the distributed deployment of multi-cloud application components as well as the initial prototype tool developed in the project. The document describes both the mechanisms and the current prototype architecture and implementation. The prototype is built on top of state-of-the-art open source solutions and is expected to be extended in the final version with more advanced features such as support to replacement of cloud providers through redeployment of components.

D3.3 Final security-based discovery and composition mechanisms and tools

The deliverable D3.3 Final security based discovery and composition mechanisms and tools of MUSA project has two components: the first is a working prototype that can be reviewed and evaluated online, while the second component is this document. This technical specification report describes the final prototype service discovery and composition software that is delivered as part of Work Package 3. This report details some of the discussions that led to change from the initial description of work and the innovation developed as part of this work package. Risk Assessment, Data Acquisition and Cloud Service Selection approach in MUSA are described in detail and references to the user guide (video) and repository of the accompanying software prototype are provided.

D3.4 Final secure multi-cloud deployment mechanisms and tools

This deliverable includes the final technical specification of the mechanisms and tools that MUSA offers to support the distributed deployment of multi-cloud application components, included in the final MUSA Deployer prototype tool developed in the project. The document describes both the mechanisms and the final prototype architecture and implementation. The prototype is built on top of state-of-the-art open source solutions and offers innovation for multi-cloud deployments as described in the document. The deliverable supersedes the initial version with additional features to support the redeployment of application components in other cloud services if required, and also the reaction to possible violations of the application Security Service Level Agreement.

D4.1 Initial security assurance mechanisms and tools

This deliverable presents different security monitoring, notification and enforcement mechanisms for multi-cloud applications. A state of the art of existing mechanisms and deployments strategies is presented. The security metrics that are targeted in the context of MUSA project are listed. The MMT-based monitoring agents as well as example of enforcement agents are also presented in detail. These agents are integrated in the MUSA security assurance platform presented in deliverable D4.2 Initial MUSA Security Assurance Platform.

D4.2 Initial MUSA Security Assurance Platform

This deliverable presents the design of the MUSA Security Assurance Platform SaaS. It explains how the monitoring, the security enforcement and the notification mechanisms are integrated into the first version of the MUSA Security Assurance Platform SaaS. The role this platform in the MUSA flow as well as the requirements addressed by this first platform version are exposed. The deliverable also presents the interaction of the MUSA Security Assurance Platform with other MUSA components namely the SLA Repository and the MUSA Deployer and how it is integrated in the MUSA framework Kanban. A highlight on the innovation brought by the platform as well as its own security features are also detailed in this deliverable.

D4.3 Final security assurance mechanisms and tools

This deliverable presents different security monitoring, notification and enforcement mechanisms for multi-cloud applications developed in MUSA. The document builds on top of the previous deliverable D4.1 Initial security assurance mechanisms and tools and completes it with progress made till the end of the MUSA project. A state of the art of existing mechanisms and deployments strategies is presented. The security metrics that are targeted in the context of MUSA project are listed. The MMT-based monitoring agents and the enforcement agents developed in MUSA are also presented in detail. These agents are integrated in the MUSA Security Assurance Platform presented in the deliverable D4.4 Final MUSA Security Assurance Platform and User manual.

D4.4 Final MUSA Security Assurance Platform and User manual

This deliverable presents the final design of the MUSA Security Assurance Platform SaaS. It explains how the monitoring, the security enforcement and the notification mechanisms are integrated into the final version of the MUSA Security Assurance Platform SaaS. The role of this platform in the MUSA workflow as well as the requirements addressed by the final version of the platform are exposed. The deliverable offers the design and implementation details of the security assurance mechanisms and the integrating parts of the MUSA Security Assurance Platform. A highlight on the innovation brought by the final platform prototype as well as its own security features are also detailed in this deliverable. A complete user manual is presented to describe how the MUSA Security Assurance can be used.

D5.1 MUSA case studies work plan

This document describes the plan for the realization of the two business case studies envisaged in MUSA project, the Case study A: Airline flight scheduling application by LHS partner and Case study B: Smart mobility services by TUT partner. The document describes the two applications and details the specific requirements for the case studies implementations, as well as the methodologies used for the work plan for carrying out the evaluation of MUSA framework in such business settings together with the evaluation methodology. The document also includes the description of the consent procedures and privacy ensuring mechanism that will be implemented in case study A.

D5.3 Results of first evaluation of MUSA framework

This deliverable reports the results of the first evaluation of the MUSA framework. According to the evaluation plan and methodology defined in deliverable D5.1, it includes the results of the evaluation on MUSA Key Results that followed a double evaluation approach: i) the requirement coverage-based approach, and ii) the user centred evaluation carried out in the project case studies. The requirement coverage evaluation assessed the fulfilment of the requirements (initially defined in deliverable D1.1) by the initial version of the MUSA Key Results. The user-centred evaluation consisted in the analysis of the quality metrics (initially defined in deliverable D5.1) on MUSA Key Results that give insights about how well they satisfy the user needs in the project case studies. The results of this initial evaluation will drive the work in all technical WPs for the improvement of the individual Key Results of the project and the framework as a whole.

D5.5 Results of first evaluation of MUSA framework

This deliverable reports the results of the final evaluation of the MUSA framework. According to the evaluation plan and methodology defined in deliverable D5.1, it includes the results of the evaluation on MUSA Key Results that followed a double evaluation approach: i) the requirement coverage-based approach, and ii) the user centred evaluation carried out in the project case studies. The requirement coverage evaluation assessed the fulfilment of the requirements (defined in deliverable D1.4) by the final version of the MUSA Key Results. The user-centred evaluation consisted in the analysis of the quality metrics (initially defined in deliverable D5.1) on MUSA Key Results that give insights about how well they satisfy the user needs in the project case studies. The results of the final evaluation drove the last improvements made on the individual Key Results of the project and the framework as a whole, while minor priority suggestions were left for future extensions or improvements.

D6.1 MUSA brochure and public website

Deliverable D6.1 MUSA brochure and public website refers to the materials that contain at this stage basic information about the project: the project website and the brochure. The website will be extended with the project results and related events. The brochure will be printed and used as first dissemination material during fairs, conferences, workshops and similar events dedicated to the MUSA project or covering similar subjects.

D6.2 Dissemination Strategy

The deliverable describes MUSA dissemination plan that details actions and common guidelines to ensure and monitor the quality of the dissemination activities. The main objective of this document is to illustrate the dissemination strategy that was elaborated during the first six months of the project. The strategy primary copes with the definition of core messages to pass to the target communities and the definition of the target communities themselves that might potentially be interested by the MUSA results. The strategy also includes the definition of a detailed plan and list of dissemination activities and the key performance indicators that will be continuously monitored to ensure the effectiveness of the plan.

D6.3 Data Management Plan

This deliverable describes the policy adopted for the management of data produced during the project activity. It described the types of data the project will generate/collect, which standard will be used, how and in which cases the data will be exploited, shared and/or made accessible to others, how the data will be curated and preserved, even after the project duration.

D6.4 Communication Plan

The Communication Plan specifies how to approach and interact with different target communities for dissemination of the MUSA project results. The plan provides details on communication methods for each of the communities. The aim of outlined communications processes is to support dissemination of the project results to maximise impact, and to learn from other related activities and projects in order to develop and improve the MUSA solution.

D6.5 Networking Plan

This deliverable aims at illustrating the MUSA networking plan. This plan details the specific networking activities with both internal and external actors to MUSA project. The internal networking activity aims to explore collaborations and knowledge exchange among MUSA partners and individuals, while the external networking activity aims to link the project to the community of stakeholders interested in the MUSA results, as well as to create synergies with other ICT projects under the same EU-ICT objective, increasing the impact of the ICT initiative.

D6.6 Dissemination, Communication and Networking Report

This deliverable describes the dissemination and communication activities followed during the first eighteen months of the project as well as the results from these activities. Moreover, this document updates project’s initial dissemination and communication plans. The document also presents the relevant networking activities executed to foster a close collaboration with projects related to MUSA, and future networking plans.

D6.7 Data Management Report

This deliverable describes the policy adopted for the management of data produced during the project activity. This deliverable includes the second release of the Data Management Plan and supersedes the previous one (D6.3 Data Management Plan). It describes the types of data the project will generate/collect, which standard will be used, how and in which cases the data will be exploited, shared and/or made accessible to others, how the data will be curated and preserved, even after the project duration.

D6.8 Final Dissemination, Communication and Networking Report

This deliverable reports the final status of dissemination, communication and networking activities performed during the second reporting period of the project and describes the value of results that MUSA gained from these activities. The document also presents in detail the key performance indicators related to these activities.

D6.9 Data Management Report

This deliverable describes the policy adopted for the management of data produced during the project activity. This is the second release of the deliverable and supersedes the previous two (D6.3, D6.7). It describes the types of data the project generated/collected, which standards were used, how and in which cases the data were exploited, shared and/or made accessible to others, how the data were curated and preserved, even after the project duration.

D7.1 Initial market study, trends, segmentation and requirements

This deliverable presents a detailed analysis of the target market of the MUSA solution, focusing on the main sectors that may influence the MUSA developments and that will guide their exploitation. The deliverable constitutes the first step towards a thorough exploitation plan that will be developed based on the findings of the present study. The document covers the MUSA context analysis, the definition of the MUSA value proposition, the value chain description, the MUSA targeted sectors and competitors analysis.

D7.2 Business scenarios analysis

This document introduces the MUSA key results from a business perspective that will be used as a reference guide to orient the MUSA results to a business-attractive approach. The Osterwalder Business canvas is used as a reference model to illustrate the diverse aspects of the potential MUSA business scenarios. Together with the business scenarios analysis, an overview of the IPR registry that the consortium has created to keep track of the property rights on the MUSA exploitable outcomes is presented.

D7.5 Standards Analysis and Strategy Plan

This deliverable presents the most relevant standards identified for the MUSA solution and the designed strategy for their adoption and inclusion in MUSA.

D7.6 Revised Standards Strategy Plan

This deliverable updates deliverable D7.5 Standards analysis and strategy plan with any new developments in cloud computing standards identified as relevant for its adoption within MUSA project and analyses which other standards have appeared in the context of the project since the initial plan. Some areas have changed in the 9 months after the previous report, e.g. TOSCA has moved on and so has CSC. This deliverable reports back on changes and outlines the management of the standards observatory going forward.

D7.7 Standards Adoption Report

This is the final report of the standards observatory for the MUSA project. It builds on work in D7.5 and D7.6 to give a final view of standards that have been observed in addition to standards that have been adopted. It may need to be read in conjunction with both those deliverables since some standards have not changed and are merely referred to in this document whilst others have moved considerably. Many of the entries in this document describe deltas from previous standards deliverables. Standards are continually evolving and being created. This is not an exhaustive analysis, but an analysis of standards that have a relationship with application composition from cloud services, secure cloud services and agile methodologies.