CISA Offers Free Security Tools to Protect Microsoft 365 and Google Workspace From Cyber Threats

The Cybersecurity and Infrastructure Security Agency (CISA) offers two free assessment tools, ScubaGear and ScubaGoggles, to help organizations identify insecure configurations in Microsoft 365 and Google Workspace.

Developed under the Secure Cloud Business Applications (SCuBA) project, these tools compare cloud tenant settings against established security baselines and generate reports that highlight configuration gaps.

CISA established SCuBA in 2022 to address cybersecurity and visibility gaps revealed by software-as-a-service intrusions. While the initiative primarily supports Federal Civilian Executive Branch agencies, it also offers guidance and assessment tools for private organizations looking to strengthen cloud security.

Rather than functioning as malware scanners, these tools evaluate whether administrative settings align with CISA’s recommended configurations. The findings help administrators identify deviations, investigate security weaknesses, and prioritize changes across their cloud services.

CISA Offers Free Security Tools

ScubaGear

ScubaGear utilizes PowerShell to query Microsoft 365 APIs and gather configuration settings. It then uses Open Policy Agent to evaluate these settings against security policies written in Rego, a declarative policy language. It can export results in HTML, JSON, and CSV formats for further review and analysis.

ScubaGear’s baseline coverage includes Microsoft Entra ID, Exchange Online, Microsoft Teams, SharePoint, Power BI, Power Platform, and security suite settings. These assessments address key areas such as identity management, email protection, collaboration controls, and application security. Additionally, SCuBA controls are mapped to NIST SP 800-53 and the MITRE ATT&CK framework.

Administrators can install ScubaGear from the PowerShell Gallery and access its source code and documentation in CISA’s GitHub repository. The assessment does not automatically remediate tenant settings; administrators must review the findings and implement necessary changes themselves.

ScubaGear supports YAML configuration files, allowing users to customize evaluations and document intentional deviations through exclusions, annotations, or omissions. This feature provides traceability for accepted risks and enables organizations to conduct consistent assessments.

ScubaGoggles

ScubaGoggles follows a similar approach to evaluating Google Workspace configurations. It primarily utilizes the Google Admin SDK API to retrieve relevant logs and settings, along with other Google APIs for organizational metadata and user privileges.

The tool assesses exported configurations against SCuBA baselines using Open Policy Agent and Rego, generating reports in HTML and JSON formats. These outputs help administrators assess policy alignment and identify areas where configuration changes may be necessary.

However, CISA identifies ScubaGoggles as an alpha-stage tool under active development. The documentation warns that the outputs may be incorrect and should be carefully reviewed, highlighting the need to validate findings before taking action based on the findings.

Together, these tools provide a repeatable assessment approach rather than offering automatic protection. Organizations can use the generated reports to guide remediation efforts, document justified exceptions, and reassess configurations after changes, while reviewing prerequisites, permissions, and tool limitations before deploying them across cloud environments.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.