CISA updates ScubaGear and ScubaGoggles, and says Microsoft 365 checks get faster

CISA released ScubaGear v2.0 and ScubaGoggles v1.1.0, new versions of the open-source tools it publishes to check Microsoft 365 and Google Workspace settings against its security baselines.

The agency calls ScubaGear v2.0 the most comprehensive update to that tool since its 2022 launch. ScubaGoggles, which launched in 2023, gets a new baseline and enhanced Gemini controls.

Both tools belong to CISA’s Secure Cloud Business Applications project, known as SCuBA, which writes configuration guidance for the cloud services federal civilian agencies use. An administrator runs a tool against a tenant, one organization’s instance of a cloud service, and gets back a list of settings that miss the baseline.

ScubaGear now calls Microsoft’s APIs directly

ScubaGear v2.0 makes direct REST API calls for every supported Microsoft 365 product. A REST API is a web interface a program can query, here for the configuration of a tenant. CISA says the change makes assessments faster and more accurate. The shift started earlier: ScubaGear 1.6.0 moved Entra ID to direct Graph API calls, and 1.8.0 moved SharePoint and Power Platform to REST calls.

ScubaGear works in three steps. It queries Microsoft 365 for configuration settings, compares them with policies written in Rego, the policy language of Open Policy Agent, and writes the results as HTML, JSON and CSV files. The baselines cover Entra ID, Defender for Office 365, Exchange Online, OneDrive for Business, Power BI, Power Platform, SharePoint Online and Teams. In 2024, CISA reported more than 30,000 downloads since the tool’s October 2022 debut.

ScubaGoggles gets an assured controls baseline

ScubaGoggles does the same job for Google Workspace. It exports settings through Google’s Admin SDK and other Google APIs, compares them with the Workspace baselines using the same policy language, and reports in HTML and JSON. The baselines cover Gmail, Calendar, Chat, Classroom, Drive and Docs, Meet, Sites and Groups for Business, plus a set of common controls.

Version 1.1.0 adds an assured controls baseline. “Resource-strapped teams can deploy a new, high-confidence set of controls tailored specifically for GWS environments, saving time and reducing friction,” CISA wrote.

The release also adds enhanced controls for Gemini, Google’s AI assistant.