#  Executive summary

This document describes the Data Management Plan (DMP) for the _Multi-cloud
Security Applications_ (MUSA) Project (see Appendix A). This is the second
release of the DMP, during the project life cycle DMP will be updated as
described in Section 1. This second version supersedes the previous
deliverable D6.3, which content is partially replicated in this document. D6.3
is _Obsolete_ after the release date of this document.

This document describes the policy adopted for the management of data produced
during the project activity. It describes the types of data the project will
generate/collect, which standards will be used, how and in which cases the
data will be exploited, shared and/or made accessible to others, and how the
data will be curated and preserved, even after the project duration.

The document is structured as follows: the introductory Section 1 describes
the DMP life cycle and explains the context of the document. Then, Section 2
gives an overview of the expected type of data to be managed. Each of the
following sections (Section 3 and Section 4) is devoted to a type of data,
describing the policies adopted for their management.

#  Introduction

##  Purpose of the document

This document describes the _Multi-cloud Security Applications_ (MUSA) Project
Data Management Plans (DMPs), as introduced in the Horizon 2020 Work Programme
for 2014-15:

_“A further new element in Horizon 2020 is the use of Data Management Plans
(DMPs) detailing what data the project will generate, whether and how it will
be exploited or made accessible for verification and re-use, and how it will
be curated and preserved._

_The use of a Data Management Plan is required for projects participating in
the Open Research Data Pilot. Other projects are invited to submit a Data
Management Plan if relevant for their planned research.”_

The MUSA DMP is a live document, updated during the project as illustrated in
Figure 1, which assumes three incremental releases of the DMPs, at months M6,
M18, and M36 (end of project) respectively.

The DMP addresses the management procedures for each type of data generated in
the project. Similarly, the DMP description document, as also introduced in
Section 1.2, will contain a section for reporting each type of data produced
during the project, as per the H2020 reporting guidelines.

DMP Initial

Release (M6)

DMP Second

Release (M18)

DMP Final

release (M36)

Any new version of DMP will include all the information of the previous
release, which will be considered obsolete from the release date of the new
DMP, i.e., the DMP released at M18 will contain all the section of DMP release
at M6. Note that if DMP released at M18 contains corrections to sections in
common with M6, the policies described in the DMP released at M18 are valid
for the remainder of the project.

Each release of the DMP, included the initial release, will report the
management policies only for the data actually produced at the release date of
the DMP. The first section after the introduction will report the description
of all the types of data that the MUSA project is expected to produce.

##  Structure of the document

The DMP contains an initial Section 2 that outlines the possible types of data
produced by the project. For each type of data, a dedicated section describes
the management policies; this release contains Section 3, devoted to
Scientific Publications and Section 4, which describes Public Reports.

Each section devoted to a type of data contains:

  1. a description of the type of data; 

  

  2. a description of the standards adopted for that data and/or a description of their format (metadata); 

  

  3. a description of the way in which such data are shared; 

  

  4. a description of how to access to such data; 

  

  5. a description of how to discover such data; 

  

  6. a description of the mechanisms used in the MUSA project to archive and preserve such data. 

  

  

The document includes in Appendix A the overview of MUSA motivation and
background, common to all MUSA deliverables.

##  Relationships with other deliverables

All deliverables indirectly affect this document, due to the data they
contain. According to Section 1.2, this deliverable contains a section for
each type of data produced by the project.

##  Contributors

All partners contributed to the definition of the policies adopted for the
data management plan, CeRICT and Tecnalia are the main contributors of the
deliverable.

The following documents are directly related to D6.7:

  * D6.3 _Data Management Plan_ (M6) contains the initial version of the DMP, delivered at month 

  

6\.

  * D6.9 _Final data management report_ (M36) will contain the final version of the DMP for MUSA project, to be delivered at the end of the project in month 36. 

#  Expected Types of Data in MUSA

In order to collect the data types that will be produced during the project,
for this second release of DMP, we focused on the description of the work and
on the results obtained in the first 18 months of the project.

According to such consideration, this section reports the data type produced
during the first months of the project. Table 1 reports a very brief
description for each of them and few considerations related to the policies to
be applied for each type of data. A complete section of DMP is dedicated for
each data type reported in Table 1.

###  Table 1: MUSA types of data available at M18  
  
<table>  
<tr>  
<th>

**Data Type**

</th>  
<th>

**Description**

</th>  
<th>

**Notes**

</th> </tr>  
<tr>  
<td>

**Scientific**

**Publications**

</td>  
<td>

Publications containing results of the project.

</td>  
<td>

Scientific publications are subject to copyrights, depending on the editorial
form they assume. DMP policies have to take into account both the need for
large diffusion and the need for a wellevaluated editorial collocation.

</td> </tr>  
<tr>  
<td>

**Public Reports**

</td>  
<td>

MUSA public deliverables and eventual internal reports and whitepapers.

</td>  
<td>

Eventual internal reports and whitepapers could be produced during the
project. DMP rules outline how they are made publicly available.

</td> </tr> </table>

According to the work done in the first eighteen months of the project, we
already identified a set of possible data types that will be made available in
the next releases of DMP. The following Table 2 reports such data types
together with few considerations for them.

Note that we removed the Multi-cloud application scenarios collected during
the first year of the project as data set, because we considered they are
useful for the MUSA framework definition, but they are already included in
Deliverable D1.1.

Moreover, we added the Cloud Threat Catalogue to the data set. Both Security
Metric Catalogue and Cloud Threat Catalogue are not publicly available yet as
they are still under work.

###  Table 2: MUSA expected types of data  
  
<table>  
<tr>  
<th>

**Data Type**

</th>  
<th>

**Description Notes**

</th> </tr>  
<tr>  
<td>

**Research Data**

</td>  
<td>

Data, which supports Scientific Publications and/or Public

Reports for validation of results.

</td>  
<td>

Annotated data of a corresponding type dependant on the context where data was
captured (e.g., different types of logs, configuration files, etc.).

</td> </tr>  
<tr>  
<td>

**Open Source**

**Software**

</td>  
<td>

Software produced during the project under Open Source licenses.

</td>  
<td>

The Consortium Agreement describes the ownership rules for the code. DMP
policies should only describe how the code is made publicly available if there
is such an interest.

</td> </tr>  
<tr>  
<td>

**Security Metrics Catalogue**

</td>  
<td>

The complete set of Security

Metrics used in the project.

</td>  
<td>

The MUSA framework focuses on supporting security aspects for multicloud
application development and operation. Security metrics are a known

</td> </tr> </table>  
<table>  
<tr>  
<th>

</th>  
<th>

</th>  
<th>

research topic and any contribution to collect standard quantifiable metrics
is of interest for the project.

</th> </tr>  
<tr>  
<td>

**Cloud Threats**

**Catalogue**

</td>  
<td>

Catalogue of security Threats and risks in Cloud.

</td>  
<td>

The MUSA framework supports tools that simplify risk analysis in the cloud, in
order to generate Security SLAs.

Cloud Security Threats, together with detailed information that helps to
identify when such threats apply are being collected and made available to the
community.

Any contribution to enlarge such Threats Catalogue is of interest for the
project.

</td> </tr> </table>

#  Scientific Publications

##  Scientific Publications Data Set Description

This data set will contain all the Scientific Publications developed in the
project for the promotion of all the MUSA results.

In the first 18 months of the project, the following Scientific Publications
have been developed:

  * “Towards Self-Protective Multi-Cloud Applications MUSA – a Holistic Framework to Support the Security-Intelligent Lifecycle Management of Multi-Cloud Applications”. Written by Erkuden Rios, Eider Iturbe, Leire Orue-Echevarria, Massimiliano Rak and Valentina Casola. Presented in CLOSER 2015 “5th International Conference on Cloud Computing and Services Science”. 

  

  * “Security in Cloud-based Cyber-physical Systems”. Written by Juha Puttonen, Samuel Olaiya Afolaranmi, Luis Gonzalez Moctezuma, Andrei Lobov, Jose L. Martinez Lastra. Presented in SecureSysComm2015. 

  

  * “Self-protecting multi-cloud applications”. Written by Antonio M. Ortiz, Erkuden Rios, Wissam Mallouli, Eider Iturbe, Edgardo Montes de Oca. Presented in IEEE Security and Privacy in the Cloud (SPC) 2015\. 

  

  * “Methodology to obtain security controls in Multi-cloud applications” Written by Samuel Olaiya Afolaranmi, Luis Gonzalez Moctezuma, Massimiliano Rak, Valentina Casola, Erkuden Rios and Jose L. Martinez Lastra. Presented in CLOSER 2016 “6h International Conference on Cloud Computing and Services Science”. 

  

  * “Enhancing Security in Cloud-based Cyber-physical Systems” Written by Juha Puttonen, Samuel Olaiya Afolaranmi, Luis Gonzalez Moctezuma, Andrei Lobov, Jose L. Martinez Lastra. Journal of Cloud Computing Research. 

  

  * “SLA-driven Monitoring of Multi-Cloud Application Components using the MUSA framework”. Written by Erkuden Rios, Wissam Mallouli, Massimiliano Rak, Valentina Casola and Antonio M. Ortiz. Presented in STAM 2016. 

  

  * “Per-service Security SLA: a New Model for Security Management in Clouds”. Written by V. Casola, A. De Benedictis, J. Modic, M. Rak, U. Villano. Presented in WETICE 2016. 

  

  * A Security SLA-driven Methodology to Set-up Security Capabilities on Top of Cloud Services”. Written by Valentina Casola, Alessandra De Benedictis, Madalina Erascu, Massimiliano Rak and Umberto Villano, (to be presented in SWISM 2016). 

  

  * “Scoring Cloud Services through Digital Ecosystem Community Analysis”. Written by Jaume Ferrarons Llagostera, Smrati Gupta, Victor Muntés-Mulero, Josep-Lluis Larriba-Pey, Peter Matthews. Presented in EC-Web 2016 (DEXA 2016 Conference). 

  

##  Standards and Metadata

Each MUSA Scientific Publication will follow the template that is asked in the
publication procedures of the different conferences, books or publications
where the publications will be presented.

##  Data Sharing

MUSA project will support the open access approach to Scientific Publication
(as defined in article 29.2 of the Grant Agreement). Scientific Publication
covered by an editorial copyright will be made available internally to the
partners and shared publicly through references to the copyright owners web
sites.

Whenever is possible, a Scientific Publication, as soon as possible and at the
latest six months after the publication time, will be deposited in a machine-
readable electronic copy of the published version or final peer-reviewed
manuscript accepted for publication in a repository for scientific
publications. Moreover, the beneficiary should aim at depositing at the same
time the research data needed to validate the results presented in the
deposited scientific publications.

TECNALIA has just finalised the development of its own repository, which is
accessible by RECOLECTA [3] (a platform that gathers all scientific
repositories at Spanish national level) and OpenAire [4] (a new platform aimed
at gathering a H2020 EU funded-projects’ scientific publications). The
repository fulfils international interoperability standards and protocols to
gain longterm sustainability.

All scientific publications of the MUSA project are intended to be available
through OpenAire repository and the potential delayed access (‘embargo
periods’) required by specific publishers and magazines will be negotiated in
a case-by-case basis.

##  Access to MUSA Scientific Publications

MUSA Scientific Publications will have open access to the deposited
publication — via the repository — at the latest:

  * On publication, if an electronic version is available for free via the publisher, or 

  

  * Within six months of publication (twelve months for publications in the social sciences and humanities) in any other case. 

  

##  Discover the MUSA Scientific Publications

For MUSA Scientific Publications, it will be ensured open access, via the
repository, to the bibliographic metadata that identify the deposited
publication. The bibliographic metadata must be in a standard format and must
include all of the following:

  * The terms "European Union (EU)" and "Horizon 2020"; 

  

  * The name of the action, acronym and grant number; 

  

  * The publication date, and length of embargo period if applicable, and  A persistent identifier. 

  

##  Archiving and Preservation

Scientific publications repositories increase visibility (and therefore the
impact) of the work of the authors and the organisations to which they belong,
using standardized international protocols that guarantee the visibility of
documents in the search engines. These same protocols allow metadata of the
repository and files within can be collected by external systems (collectors)
to offer new services (e.g., search across multiple repositories, etc.).
TECNALIA owns the _TECNALIA Publications_ repository, which is an open access
repository accessible by RECOLECTA [3] and OpenAire [4] as explained before.
The _TECNALIA Publications_ repository is visible through Google and fulfils
international interoperability standards and protocols to gain long-term
sustainability.

The aim of the consortium is that all scientific publications of the MUSA
project will be available through the OpenAire repository, which allows
searching publications per project. The potential delayed access (‘embargo
periods’) required by specific publishers and magazines will be negotiated in
a case-by-case basis.

#  Public Reports

MUSA produces, as an open set of data, a number of reports, which summarize
the main project activities and deliverables, marked as public.

The project deliverables will be publicly released, when it is prescribed in
the description of the work, only after the acceptance from the European
Commission. Internal reports and whitepapers will be made publicly available
according to an agreement among the report authors.

##  Public Report Data Set Description

The following table shows the Public Deliverables at month 18 of the project.
It is worth noticing that all the deliverables in the list are already
delivered, but not yet publicly available, waiting for EC approval.

####  Table 3: Public deliverables at M18  
  
<table>  
<tr>  
<th>

**Deliverable (number)**

</th>  
<th>

**Deliverable name**

</th>  
<th>

**Work package number**

</th> </tr>  
<tr>  
<td>

D1.1

</td>  
<td>

Initial MUSA framework specification.

</td>  
<td>

WP1

</td> </tr>  
<tr>  
<td>

D1.2

</td>  
<td>

Guide to security management in multi-cloud applications lifecycle.

</td>  
<td>

WP1

</td> </tr>  
<tr>  
<td>

D2.1

</td>  
<td>

Initial SbD methods for multi-cloud applications.

</td>  
<td>

WP2

</td> </tr>  
<tr>  
<td>

D5.1

</td>  
<td>

MUSA case studies work plan

</td>  
<td>

WP5

</td> </tr>  
<tr>  
<td>

D6.1

</td>  
<td>

MUSA brochure and public website

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D6.2

</td>  
<td>

Dissemination Strategy

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D6.3

</td>  
<td>

Data Management Plan

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D6.4

</td>  
<td>

Communication Plan

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D6.5

</td>  
<td>

Networking plan

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D6.6

</td>  
<td>

Dissemination, communication and networking report

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D6.7

</td>  
<td>

Data management report

</td>  
<td>

WP6

</td> </tr>  
<tr>  
<td>

D7.1

</td>  
<td>

Initial market study, trends, segmentation and requirements

</td>  
<td>

WP7

</td> </tr>  
<tr>  
<td>

D7.2

</td>  
<td>

Business scenarios analysis

</td>  
<td>

WP7

</td> </tr>  
<tr>  
<td>

D7.5

</td>  
<td>

Standards analysis and strategy plan

</td>  
<td>

WP7

</td> </tr>  
<tr>  
<td>

D7.6

</td>  
<td>

Revised standards strategy plan

</td>  
<td>

WP7

</td> </tr> </table>

##  Standards and MetaData

MUSA Public Deliverables have a standard template available on the internal
document management system (https://intranet.musa-project.eu). The Executive
summary, at the beginning of the document is a brief summary of the
deliverable content. All the information about the document is reported in
Section 1 (Introduction).

All Introduction sections contain:

  * A description of the purpose of the deliverable (section 1.1). 

  

  * A description of the structure of the deliverable (section 1.2). 

  

  * A description of relationships with other deliverables (section 1.3). 

  

  * A list of contributors (section 1.4). 

  

  * A section devoted to summarize acronyms and abbreviations (section 1.5). 

  

  * A section that reports the revision history (section 1.6). 

  

  * A section that describes the changes applied in different versions after evaluation of the Commission (section 1.7) - optional 

  

##  Data Sharing

All public report/deliverables will be published through the MUSA website [1].
In the website of the MUSA project there is a section where all the MUSA
Public Results will be published and made available for free to the general
public.

##  Access to MUSA Public Deliverables

The access to the public repository can be done through the Public Results
section of the MUSA website.

For accessing to these public reports no identification is required.

##  Discover the MUSA Public Deliverables

The MUSA website will be made as visible as possible and discovering should be
possible through any web search engine.

##  Archiving and Preservation

All final versions of the deliverables are maintained on the internal document
management system  ( _https://intranet.musa-project.eu_ )  , based on
Alfresco. All reports available on the web site are archived together with web
site infrastructure (see D6.1 _MUSA brochure and public website_ ).