[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6RmbXXtTeqrxq0i8vs1kEo7sKSJJKMXxzjmQQVOwbWo":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":87},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"c64830af-a760-4f7e-8691-f7555a41aa4f","CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace","cisa-offers-two-free-tools-to-detect-security-misconfigurations-in-microsoft-365-22d1b4","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers two free tools to help organizations find security misconfigurations in Microsoft 365 and Google Workspace. ScubaGear and ScubaGoggles compare cloud settings against recommended security baselines, giving administrators a clearer view of weaknesses that need attention. Both are available to government agencies and private businesses. The tools […] The post CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace appeared first on Cyber Security News.","CISA offers two free assessment tools—ScubaGear and ScubaGoggles—to help organizations identify security misconfigurations in Microsoft 365 and Google Workspace. These tools compare cloud settings against CISA's secure configuration baselines and are available to both government agencies and private businesses. The tools generate reports in multiple formats and integrate with CISA's broader Secure Cloud Business Applications (SCuBA) project, which aims to address security gaps in cloud services.","CISA releases ScubaGear and ScubaGoggles, free tools to detect security misconfigurations in Microsoft 365 and Google","https:\u002F\u002Fcybersecuritynews.com\u002Fcisa-free-tools-to-detect-misconfigurations\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FCISA-Offers-Two-Free-Tools.webp","2026-10-27T15:31:45+00:00","2026-10-27T16:00:15.780717+00:00",7,[17,20,22,24,27,29],{"name":18,"type":19},"CISA","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":19},"Google",{"name":25,"type":26},"ScubaGear","product",{"name":28,"type":26},"ScubaGoggles",{"name":30,"type":31},"Open Policy Agent","technology","02371804-cf6d-4449-98de-f1a2d4d9b266",{"id":32,"icon":34,"name":35,"slug":36},null,"Tools","tools",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[21,23,18],{"controls":56,"vendors":86},[57],{"slug":58,"name":59,"problem":60,"products":61},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",[],{"slug":88,"title":89,"body":90,"framework_refs":91,"framework_notes":99},"cisa-releases-free-tools-to-catch-cloud-security-misconfigurations","CISA Releases Free Tools to Catch Cloud Security Misconfigurations","Misconfigured cloud environments in Microsoft 365 and Google Workspace represent one of the most common and preventable attack surfaces in modern organizations. Many breaches stem not from novel exploits but from default or incorrectly applied settings that deviate from security baselines. CISA's ScubaGear and ScubaGoggles tools address this gap by automatically comparing an organization's cloud configuration against established secure baselines. The availability of these free tools underscores how widespread the misconfiguration problem is and how many organizations lack the internal capability to audit their own cloud settings. Failing to assess and remediate cloud misconfigurations leaves sensitive data and systems exposed to unauthorized access, privilege escalation, and data exfiltration.",[92,93,94,95,96,97,98],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 18: Penetration Testing","NIS2 Article 21(2)(b)","DORA Article 9",{"DORA Article 9":100,"NIS2 Article 21(2)(b)":101,"CIS Control 18: Penetration Testing":102,"NIST SP 800-53 SI-2: Flaw Remediation":103,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":104,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":105,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":106},"DORA mandates that financial entities manage ICT security risks including proper configuration of cloud-based tools, making regular configuration assessments a compliance requirement under this regulation.","NIS2 requires entities to implement policies on risk analysis and information system security, including ensuring cloud service configurations meet accepted security standards.","Running configuration assessment tools like ScubaGear mirrors the intent of this control—proactively testing cloud environments to surface exploitable weaknesses before attackers do.","Misconfigurations in cloud services function like unpatched flaws; SI-2 requires organizations to identify and correct such weaknesses in their information systems on a defined schedule.","Security misconfigurations are a category of technical vulnerability; this control requires organizations to systematically identify and remediate them before they are exploited.","This control directly mandates establishing and maintaining secure configurations for cloud platforms, which is precisely what ScubaGear and ScubaGoggles audit against CISA's baselines.","Many M365 and Google Workspace misconfigurations directly weaken authentication and access controls, and this CSF outcome requires those protections to be correctly configured and maintained."]