CISA’s ScubaGear and ScubaGoggles check cloud security settings
Original title: CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace
The existing SCuBA tools report configuration gaps in Microsoft 365 and Google Workspace but do not change tenant settings.
CISA offers ScubaGear and ScubaGoggles, free tools that compare Microsoft 365 and Google Workspace settings with secure configuration baselines. Both are available to government agencies and private organizations and come from the Secure Cloud Business Applications project, with the assessment tools introduced in 2023. ScubaGear covers Entra ID, Exchange Online, Teams, SharePoint, Power BI, and Power Platform, while ScubaGoggles uses Google APIs. Reports identify gaps; administrators must review and change settings themselves.
- ScubaGear is installed with Install-Module -Name ScubaGear after checking permissions.
- It queries Microsoft 365 APIs with PowerShell and evaluates rules through Open Policy Agent.
- ScubaGear outputs HTML, JSON, and CSV; ScubaGoggles outputs HTML and JSON.
- CISA labels ScubaGoggles alpha and warns that results could be incorrect.
- SCuBA began in 2022 and primarily supports federal civilian agencies.
- Organizations
- CISA
- Countries
- United States
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) offers two free tools to help organizations find security misconfigurations in Microsoft 365 and Google Workspace.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.