InfoSecBulletin Cybersecurity for mankind
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) provides two free tools to help organizations spot security flaws in Microsoft 365 and Google Workspace. ScubaGear and ScubaGoggles check cloud settings against security standards, showing admins where to focus their efforts. Both tools are available to government agencies and private companies.
The tools are part of CISA’s Secure Cloud Business Applications project, or SCuBA. This project started in 2022 to fix security and visibility issues caused by attacks on cloud services. In 2023, CISA released the assessment tools, so they are now existing resources, not new products.
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
SCuBA mainly helps Federal Civilian Executive Branch agencies, but anyone can use its guidance. The baselines are meant to keep safe information made, used, shared, or stored in cloud apps while letting organizations think about their own needs and risks.
ScubaGear Checks Microsoft 365 Security
ScubaGear looks at a Microsoft 365 tenant, which is an organization’s online space, to see if it meets CISA’s safety rules. It covers Microsoft Entra ID, Exchange Online, Teams, SharePoint, Power BI, and Power Platform. These checks help managers look over security settings for identity, email, teamwork, and apps in one process.
The tool uses PowerShell to ask Microsoft 365 for configuration data. It then sends those settings to Open Policy Agent, which checks them using rules in the Rego policy language. Results are created in HTML, JSON, and CSV formats for review and more analysis.
Administrators can install ScubaGear through PowerShell Gallery using Install-Module -Name ScubaGear. However, they must first review required permissions and dependencies. The assessment identifies gaps without automatically fixing tenant settings, leaving administrators responsible for reviewing findings, making changes, or documenting accepted risks.
The project links to CISA’s larger cloud security rules. Cyber Security News wrote about CISA’s Microsoft 365 security rules, which ask federal agencies to improve cloud settings and use SCuBA checks.
ScubaGoggles Evaluates Google Workspace Settings
ScubaGoggles offers a similar review for Google Workspace. It mainly uses the Google Admin SDK API and other Google APIs to gather important settings, logs, organization info, and user rights. Open Policy Agent checks this data against basic needs, creating HTML and JSON reports.
An important issue needs to be noted. CISA calls ScubaGoggles an alpha tool still being developed and says the results might be wrong. Administrators should check findings closely and do any necessary manual checks instead of seeing an automated report as a full security review.
CISA gives advice on Hybrid Identity Solutions for groups linking local identity systems with cloud services. This supports the identity security issues in CISA’s Active Directory security guidance, especially when groups need to see and fix weaknesses in connected systems.
These tools help security teams check for configuration gaps regularly. By looking over the results, noting justified exceptions, and assessing changes, organizations can see improvements without mixing up baseline alignment with being safe from attacks.
