The Cybersecurity and Infrastructure Security Agency (CISA) has released two complimentary tools, ScubaGear and ScubaGoggles, designed to detect security misconfigurations within Microsoft 365 and Google Workspace environments. These tools aim to assist both governmental bodies and private enterprises in identifying and addressing security vulnerabilities by comparing cloud settings with established security baselines.
The SCuBA Project and Its Objectives
Part of CISA’s Secure Cloud Business Applications (SCuBA) initiative, launched in 2022, these tools address critical security gaps revealed by cloud service attacks. Although introduced in 2023, these assessment tools are part of CISA’s ongoing efforts rather than new offerings. SCuBA primarily targets Federal Civilian Executive Branch agencies but extends its guidance to any organization seeking enhanced cloud security.
The security baselines provided are tailored to safeguard information across cloud platforms, allowing organizations to balance protection with their specific business objectives and risk evaluations.
ScubaGear: Focusing on Microsoft 365
ScubaGear offers a thorough evaluation of Microsoft 365 environments by checking configurations against CISA’s recommended security baselines. This tool covers various Microsoft applications such as Entra ID, Exchange Online, Teams, SharePoint, Power BI, and Power Platform. By leveraging PowerShell to access configuration data, ScubaGear uses Open Policy Agent to assess these settings against defined rules, generating reports in multiple formats for further scrutiny.
Installation is facilitated through PowerShell Gallery, but administrators must first confirm necessary permissions and dependencies. While ScubaGear highlights security gaps, it requires administrators to manually address any issues identified.
ScubaGoggles: Analyzing Google Workspace
ScubaGoggles performs a similar function for Google Workspace, utilizing the Google Admin SDK API alongside other Google APIs to gather vital settings and user data. The Open Policy Agent then evaluates these against baseline criteria, providing reports in HTML and JSON formats. However, as an alpha-stage tool, ScubaGoggles may produce inaccurate results, necessitating careful validation of its findings by administrators.
In addition to these tools, CISA offers Hybrid Identity Solutions Guidance to support organizations integrating local identity systems with cloud services, complementing its Active Directory security recommendations.
For security teams, these tools offer a standardized method for identifying configuration vulnerabilities. By routinely reviewing and documenting findings, organizations can track their security improvements effectively, ensuring that baseline alignment does not equate to guaranteed security.
As cyber threats evolve with AI advancements, it is crucial for defenses to adapt swiftly to maintain robust security measures.
