CISA Releases Free Tools to Detect Microsoft 365 and Google Workspace Misconfigurations
CISA has launched two free tools, ScubaGear and ScubaGoggles, to help organizations identify and remediate security misconfigurations in Microsoft 365 and Google Workspace environments.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has made available two free tools designed to assist organizations in identifying security misconfigurations within their Microsoft 365 and Google Workspace environments. These tools, named ScubaGear and ScubaGoggles respectively, function by comparing an organization's current cloud settings against established security baselines, thereby providing administrators with a clearer understanding of potential weaknesses that require attention.
Both ScubaGear and ScubaGoggles are part of CISA's Secure Cloud Business Applications (SCuBA) project, which was initiated in 2022 to address the security and visibility gaps that have become apparent due to increasing attacks targeting cloud services. While the SCuBA project primarily serves Federal Civilian Executive Branch agencies, the guidance and tools it produces are accessible to any organization seeking to enhance its cloud security posture. The security baselines are intended to protect sensitive information handled within cloud applications while allowing organizations to tailor their security measures according to their specific business needs and risk tolerance.
ScubaGear is specifically designed to assess Microsoft 365 tenants, covering critical components such as Microsoft Entra ID, Exchange Online, Teams, SharePoint, Power BI, and the Power Platform. It aids administrators in reviewing identity, email, collaboration, and application security settings through a unified assessment process. The tool leverages PowerShell to query Microsoft 365 application programming interfaces for configuration data. This data is then processed by Open Policy Agent, which evaluates the settings against rules written in the Rego policy language. The assessment results are generated in HTML, JSON, and CSV formats, facilitating detailed review and analysis by administrators. ScubaGear can be installed via the PowerShell Gallery, but users must first review the necessary permissions and dependencies.
It is important to note that ScubaGear identifies configuration gaps but does not automatically rectify tenant settings. Administrators are responsible for reviewing the findings, implementing necessary changes, or documenting any accepted risks. This approach aligns with CISA's broader cloud security requirements, including its directive for federal civilian agencies to strengthen Microsoft 365 configurations and utilize SCuBA assessments.
Complementing ScubaGear, ScubaGoggles offers a similar assessment capability for Google Workspace environments. It primarily utilizes the Google Admin SDK API, along with other Google APIs, to gather relevant configuration settings, logs, organizational details, and user privileges. Similar to ScubaGear, Open Policy Agent is employed to compare the collected data against baseline security requirements, producing reports in HTML and JSON formats. However, CISA explicitly labels ScubaGoggles as an alpha tool that is still under active development, warning that its results may be inaccurate. Administrators are strongly advised to carefully validate the findings and complete any necessary manual checks, rather than relying solely on the automated report for a complete security review.
In addition to these assessment tools, CISA also provides guidance on Hybrid Identity Solutions, which is crucial for organizations that connect their on-premises identity systems with cloud services. This guidance complements existing CISA advisories on Active Directory security, offering a more comprehensive approach to managing security across interconnected environments. For security teams, these tools offer a repeatable method for measuring configuration gaps and tracking improvements over time. By regularly reviewing findings, documenting justified exceptions, and re-running assessments after making changes, organizations can effectively monitor their progress towards aligning with security baselines and reducing their attack surface.