CISA offers free ScubaGear and ScubaGoggles cloud configuration assessment tools
Original title: CISA Offers Free Security Tools to Protect Microsoft 365 and Google Workspace From Cyber Threats
ScubaGear checks Microsoft 365 with PowerShell and Rego; alpha ScubaGoggles may misreport Google Workspace settings.
CISA’s Secure Cloud Business Applications project provides ScubaGear and ScubaGoggles, free tools that compare Microsoft 365 and Google Workspace tenant settings with CISA baselines. ScubaGear uses PowerShell and Open Policy Agent across Entra ID, Exchange Online, Teams, SharePoint, Power BI, Power Platform, and security settings, and does not change configurations. ScubaGoggles, marked alpha, reads Google Admin SDK data; CISA says its output may be wrong and should be verified.
- SCuBA started in 2022 after SaaS intrusion visibility gaps.
- ScubaGear exports HTML, JSON, and CSV and installs from the PowerShell Gallery.
- Baselines map to NIST SP 800-53 and the MITRE ATT&CK framework.
- YAML files let teams record exclusions and accepted deviations.
- ScubaGoggles writes HTML and JSON and remains under active development.
- Organizations
- CISA
From the original article
2 min read at gbhackers.com
The Cybersecurity and Infrastructure Security Agency (CISA) offers two free assessment tools, ScubaGear and ScubaGoggles, to help organizations identify insecure configurations in Microsoft 365 and Google Workspace.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.