FP7-PEOPLE-2012-ITN EID Grant agreement no.: 317387 www.secentis.eu Deliverable 1.2 Project Presentation Abstract This document describes the training program, the objectives, the expected results, the duration and the partners of the SECENTIS project. It also includes two sets of slides and a poster/flyer that have been prepared for presenting the project, together with the project website. Deliverable details Deliverable version: v1.0 Classification: public Date of delivery: August 29 th, 2013 Due on: May 31 st,, 2013 Editors: FBK (A. Armando, S. Ranise, L. Segalla) Total pages: 18 Start date: April 1 st, 2013 Project Coordinator: Prof. Alessandro Armando Partners: FBK, SAP Project details Duration: 48 months
Contents 1. Project Overview... 3 1.1 Project information... 3 1.2 List of Participants (full beneficiaries)... 3 1.3 List of Associated Partners (including role and status)... 3 1.4 The overall goal of the SECENTIS project... 4 1.5 Project objectives... 5 1.6 Overall strategy of the work plan... 6 2 Project Presentation Slides... 7 3 Project Presentation Poster and Flyer... 16 4 Project Website... 17 2/18
1. Project Overview 1.1 Project information Project title: A European Industrial Doctorate on Security and Trust of Next Generation Enterprise Information Systems Acronym: SECENTIS Project number: 317387 Programme: Seventh Framework Programme (FP7) Call identifier: FP7-PEOPLE-2012-ITN Implementation mode: EID Start date: April 1 st, 2013 End date: March 31 st, 2017 Duration: 48 months Total cost: 1,219,539.36 EC contribution: 1,219,539.36 Website: www.secentis.eu For copies of reports, updates on project activities and other SECENTIS-related information, contact: FBK Alessandro Armando armando@fbk.eu Povo - Via Sommarive 18 Phone: +39 0461 314 193 I-38123 Trento, Italy Fax: +39 0461 314 380 1.2 List of Participants (full beneficiaries) Part. Part. Short name Private Sector SME Month enter Month exit Country N (Y/N) (Y/N) project project 1 FBK Y N 1 48 Italy 2 SAP Y N 1 48 Germany 1.3 List of Associated Partners (including role and status) N Associated Partner name 1 University of Trento, Department of Information Engineering and Computer Science 2 Associazione Trento RISE Short name Country Organisation type SME (Y/N) Role in Project UNITN Italy Public N RES, TR, SEC Trento RISE Italy Public N TR, SEC 3/18
1.4 The overall goal of the SECENTIS project The main goal of the SECENTIS project is to provide an innovative training program at the Doctoral level to educate a new generation of security experts capable to tackle the scientific and technical challenges raised by the combination of new technologies (e.g., cloud computing, mobile applications, and the Software-as-a-Service paradigm) and to manage the impact of these changes in industry. The SECENTIS training program stems from a carefully selected set of research activities aiming at devising cutting-edge solutions that will improve the security of the next generation of Enterprise Information Systems and Process Management solutions. Over the past few years, the IT landscape transformed rapidly taking advantage of the consolidation of virtualization technologies and service oriented architectures as well as of the emergence of new data consumption devices. Today, Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), and Softwareas-a-Service (SaaS) may be valid alternatives to traditional IT systems for both the public and the business world. A multitude of vendors propose to host traditional systems (e.g., Amazon cloud), to develop generic software with advanced Software Development Kit (e.g., Microsoft Azure) and to customize dedicated software with mash-ups integrating social network ideas (e.g., the Facebook SDK). The development and execution of this generation of software raise new challenges since the ownership of servers, software, and data is blurred and can span across organizations and countries. SAP is embracing this (r)evolution by extending the availability of its software and by bringing businesses together with solutions that integrate on-premise and on-demand software with a complete and complementary set of tools to access enterprise data (e.g., fat, web and mobile clients). These solutions are delivered to enterprises as a service ecosystem, where a full suite of enterprise software (including Human Resources, Supply Chain, Finance and Customer Relationship modules) are hosted in the cloud enabling partners and customers toadapt the system's capabilities or build cloud-based extensions. Ultimately, the SAP offer will provide end-to-end business processes across organisational boundaries able to support the emergence of a business market place for add-ons provided by Independent Software Vendors. The infrastructure is based on the following layered architecture that comprises a DBMS Layer, a PaaS Layer, and a SaaS Layer. Image 1 SAP Hana Architecture Security is of course critical for the new SAP Application Infrastructure, but it is also very difficult to attain because of the multi-faceted nature of the problem: sensitive data must be dealt with in accordance 4/18
to regulations and internal policies; third-parties applications must be certified before deployment; even applications developed internally by a company must be closely inspected to detect and eliminate vulnerabilities that could enable misuse by unauthorized users; mechanisms should be put in place to prevent and/or detect frauds by authorized users involved in the execution of business processes. The research training projects developed by the Young Researchers are summarized in the Table 1. They will address various aspects of access control in the DBMS and PaaS layers (Topics I and II), enhance the security and trust of third-party business applications in the SaaS layer (Topic III), and provide automated security analysis techniques to support the design of composed business processes in the PaaS layer (Topic IV) and of browser-based protocols that ease the use of business applications in the SaaS layer (Topic V). 1.5 Project objectives The SECENTIS project has four main training objectives (TO): TO1: Expertise on the security of Enterprise Information Systems. By achieving this objective the ESRs will acquire an in-depth knowledge about one of the most critical aspects of the next generation Enterprise Information Systems. This objective can only be achieved through a training program that tightly combines advanced formal training on Information Security with hands-on experience on a state-of-the-art, industrial-strength software platform. This is exactly the kind of training offered by the SECENTIS project. The fulfilment of a PhD in this area implies the achievement of this objective. TO2: Communication skills. The ability to present technical and innovative ideas in an effective way is of crucial importance both in industry and in academia. The achievement of this objective can be assessed by observing the quality of the presentations as well as of the scientific manuscripts written by the ESRs. TO3: Design and management of R&D projects. The ability to design and effectively manage R&D projects is a very important training objective of an industrial doctorate. The achievement of this objective can be assessed by observing the ability of the ESRs to organize their own research work and coordinate their work with others in the context of the SECENTIS work plan. TO4: Entrepreneurship and Innovation. Scientific discoveries are key to the improvement of existing technologies and are prerequisite of the creation of new business opportunities. However only scientists with an entrepreneurial mind-set and an innovation-oriented attitude can achieve the concretization of these opportunities. To this end, formal training must be complemented with activities fostering creativity and students should be immersed in a stimulating working environment that facilities the migration of new ideas into cutting-edge technical solutions. The creation of such an environment is a primary goal of the SECENTIS project. Table 1 The 5 topics of the SECENTIS project. Topic Project Title Host Institution 1 Risk-based Access Control FBK 2 Security Policy Enforcement and Monitoring FBK 3 Certification of Third-parties Applications FBK 4 Automatic Security Analysis of Business Processes FBK 5 Automatic Analysis of Browser based Security Protocols FBK 5/18
1.6 Overall strategy of the work plan The SECENTIS project aims at maximizing the quality and quantity of training for the ESRs along the research, education and innovation axes. To achieve this ambitious goal we have structured the work plan in a number of phases: Phase 1: Advertisement and Candidates Selection. The first phase of the project will be devoted to advertising the posts of the ESRs and to the selection of the candidates. A description of the advertisement strategy and the selection procedure is given in Section below. Phase 2: Training on Entrepreneurship and Innovation. The selected ESRs will be invited to Trento and participate in the training activities of the ICT Labs Doctoral Training Center of Trento RISE. This will stimulate their creativity and help them to achieve an entrepreneurial and innovation-oriented mind-set. The ESRs will be also guided in the preparation of their Career Development Plan (Deliverable D1.4), which is subject to approval by the Supervision Board (Milestone M3). During this period the ESRs will also study and identify the research topic to tackle during their PhD (Milestone M5). In this activity they will be supported by the key scientific personnel of the consortium and supervised by the Supervision Committee. Phase 3: Assessment of State-of-the-Art. With the enrolment to the ICT Doctoral School (month 10) the ESRs will officially start their PhD (Milestone M4). Their first task will be a thorough analysis of the state-ofthe-art relative to their own research topic (Milestone M5 and Deliverable D2-6.1). This will be done in the premises of FBK (ESR1, ESR4, ESR5) and of UNITN (ESR2 and ESR3). At the same time the ESRs will benefit from formal training by taking classes offered by the ICT Doctoral School and by the Master Programme in Security & Privacy. Phase 4: Selection of Case Studies. At month 16, ESRs will move to SAP Research in Sophia Antipolis with the goal of identifying case studies within the SAP Application Infrastructure relevant for his research. To this end, they will take hands-on classes on the SAP Application Infrastructure and will closely interact with their SAP advisor. The possibility to undergo additional formal training at Eurécom will be also considered on an individual basis and decided by the Supervision Committee. Phase 5: Beyond the State-of-the-Art. In accordance with the rules of the ICT Doctoral School at month 22 the ESRs will return to Trento to undergo the Qualifying Exam. In preparation to the Qualifying Exam, the ESRs will submit a PhD Project Plan where they must clearly state the scientific challenges that they plan to tackle the state-the-art in the field, and an outline of the research methodology that they plan to use. Since failure to pass the qualifying exam implies termination of the PhD, this is a critical milestone for the ESRs and the project as a whole. To mitigate the risk of failure a number of measures will be taken, including (i) weekly supervision meetings with the advisors in the months 19-22, (ii) detailed review of the PhD Project Plan by the advisors, (iii) rehearsal of all the presentations by ESRs during the Second Project Meeting (Deliverable D1.7) that will allow the ESRs to get timely feedback from the Supervisory Board, and (iv) ESRs will be allowed to take the Qualifying Exam twice according to the current regulations of the ICT International Doctorate School of UNITN. The technical objective of this phase is to identify novel technical solutions to the scientific challenges set in the PhD Project Plan. This activity will be done under the close supervision and help of the respective advisor at FBK or at UNITN. During this period the ESRs will also complete the formal training by taking a final class at UNITN. Phase 6: Proof-of-Concept Implementation in SAP Application Infrastructure. The ESRs will then go back to SAP for a period of 12 months to refine the technical solutions developed in the previous phase and assess their effectiveness through the development of a Proof-of- Concept implementation in the SAP Application Infrastructure. This phase will be a challenge in itself, since the ESRs will have to turn the innovative technical solutions developed with their academic advisor into a working prototype within a platform of industrial complexity. The ESRs will benefit of the close supervision of their SAP advisors and, more in general, of the SAP Research environment. The Third Project Meeting (Deliverable D1.9) will be hosted by SAP in Sophia Antipolis and scheduled right in the middle of this period. This will give the ESRs the opportunity to present their preliminary results and prototypes and receive feedback in a plenary session, i.e. attended by all advisors (both from industry and academia). Experts from the relevant business units of SAP will be also invited to participate and will be asked to contribute to draft the migration path of the proposed solutions into the SAP Application Infrastructure. 6/18
Phase 7: Writing the PhD Thesis. The ESRs will return to Trento to fine tune their techniques and complete the writing of the thesis. Phase 8: Industry Migration. Finally, SAP will evaluate internally the pertinence of the results from a business perspective taking into account the adequateness of the different ESR results with the product roadmap using as main input the Deliverable D7.4 and the result of the Third Project Meeting (Deliverable D1.9). The positive evaluations will be discussed with the partners during the final project meeting (e.g., Deliverable D1.11) and the selected ESRs will be offered to work toward the concrete integration of their results on real existing products or to work with the SAP Research Business development team to build a business plan to submit to the SAP internal incubator. This last phase will be funded by SAP. 2 Project Presentation Slides In this section there are the following sets of slides: 1. SECENTIS Project Kickoff Meeting 2. Brief overview or Research Topics. They provide respectively a presentation of the project and its scientific topics. These slides have been given already at a number of meetings, in particular, at the Kick-off meeting and the Selection meeting held in Trento at March 20th and May 23-24, 2013. 7/18
8/18
9/18
10/18
11/18
12/18
13/18
14/18
15/18
D1.2 Project Presentation 3 Project Presentation Poster and Flyer The following poster aimed to advertise the posts of the ESRs. It was also used as a flyer and it has been spread through the network of the project (SAP and associated partners). Furthermore it was exhibited in the stand of SAP at the fifth edition of ICT Days (http://2013.ictdays.it), an initiative organized by the Department of Information Engineering and Computer Science of the University of Trento, in collaboration with Trento RISE and FBK. The ICT Days are an important event that aims to create networking opportunities for students, businesses, universities and research centers in the Information Communication Technology area. Image 2 Poster/flyer on SECENTIS project. 16/18
4 Project Website The web site (www.secentis.eu) has been launched in February 2013. It provides general information about the project and the 5 ESRs positions and it is organized in the following sections: Home. Here it is presented the general purpose of the project. Research. This section describes the research challenges tackled by SECENTIS. Training. This page offers a general overview of the 5 research topics that will be developed within the project. Consortium. Here there is a short presentation of the partners. Highlights. The call of the 5 ESRs position is presented. In this section are reported the same information inserted also in the poster/flyer. After the beginning of the research activities by the 5 ESRSs, the web site will be a channel where to insert news about SECENTIS, events organized by the partners, public documents generated by the project (publications and public deliverables) and all the relevant information linked to it. Image 3 Home page of the SECENTIS web site. 17/18