Cumulus: A Cloud-Based Internet of Things Testing Platform

IoT capabilities present powerful opportunities to the military for increasing situational awareness, bolstering risk assessment, and improving response times. The U.S. Air Force is steadily deploying new IoT and sensor-connected systems to create intelligent data links, track and destroy adversarial weapons systems, and build "smart" military bases.  IoT security testing has not kept pace with the rapid innovation and deployment of IoT systems. How can the Air Force securely develop and deploy IoT applications? The Air Force has adopted DevSecOps – a modern methodology that prioritizes security throughout the enterprise software development lifecycle. IoT applications share many similarities with enterprise software systems, but the DevSecOps processes used by the Air Force lack the tools needed to support secure development, testing, integration, and delivery of IoT applications. The Air Force needs a solution: automated IoT testing.  To close this gap, Grier Forensics proposes developing Cumulus, a Cloud-Based IoT Test and Integration platform, for securing Air Force IoT application development. Cumulus is an extensible testing framework built on the cloud, extracting common IoT patterns and testing approaches, minimizing the effort needed to meet DoD acquisition and testing requirements for IoT systems. Cumulus automates IoT testing across the DevSecOps pipeline, including device-level security testing, acceptance testing using simulated devices and mock cloud-service endpoints, and integration testing using DoD-approved continuous integration and delivery (CI/CD) services.  Cumulus automates the CI/CD workflow for IoT systems, leveraging concepts and interfaces from existing cloud-based CI platforms. Cumulus is designed to be integrated with the DoD’s Platform One, a modern cloud platform that hosts continuous integration tools and pipelines for DoD Enterprise DevSecOps. This integration will enable the Air Force and other organizations to rapidly generate IoT testing procedures and test reports that map directly to DoD acquisition requirements. Cumulus provides end-to-end DevSecOps for IoT systems of any scale, unlocking rapid, secure IoT innovation for the Air Force and industry.  Grier has received the support of multiple industry and defense partners for the further development of Cumulus.