[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frHSgcVooRXRrhbu6Qo5q7QglBZMOlXwXvcsrruEBm4I":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"22aa565c-0be0-4584-a546-e9a6d2293ac5","cisa-releases-free-tools-to-catch-cloud-security-misconfigurations","c64830af-a760-4f7e-8691-f7555a41aa4f","CISA Releases Free Tools to Catch Cloud Security Misconfigurations","Misconfigured cloud environments in Microsoft 365 and Google Workspace represent one of the most common and preventable attack surfaces in modern organizations. Many breaches stem not from novel exploits but from default or incorrectly applied settings that deviate from security baselines. CISA's ScubaGear and ScubaGoggles tools address this gap by automatically comparing an organization's cloud configuration against established secure baselines. The availability of these free tools underscores how widespread the misconfiguration problem is and how many organizations lack the internal capability to audit their own cloud settings. Failing to assess and remediate cloud misconfigurations leaves sensitive data and systems exposed to unauthorized access, privilege escalation, and data exfiltration.","**Immediate actions:**\n- Download and run CISA's ScubaGear (M365) and ScubaGoggles (Google Workspace) tools against your cloud tenants to identify existing misconfigurations.\n- Review generated reports and prioritize remediation of any settings that deviate from CISA's secure configuration baselines.\n\n**Long-term improvements:**\n- Establish a recurring schedule (at minimum quarterly) for cloud configuration assessments and enforce configuration drift detection.\n- Adopt Infrastructure-as-Code (IaC) practices to codify approved cloud configurations and prevent unauthorized manual changes.\n- Assign clear ownership of cloud platform security configurations to a dedicated team or individual with accountability metrics.\n\n**Detection measures:**\n- Integrate cloud configuration assessment tools into your CI\u002FCD pipeline or change management process to catch misconfigurations before they reach production.\n- Enable cloud-native audit logging (e.g., Microsoft Purview Audit, Google Workspace Admin Audit Logs) and alert on configuration changes in real time.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 18: Penetration Testing","NIS2 Article 21(2)(b)","DORA Article 9",{"DORA Article 9":20,"NIS2 Article 21(2)(b)":21,"CIS Control 18: Penetration Testing":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"DORA mandates that financial entities manage ICT security risks including proper configuration of cloud-based tools, making regular configuration assessments a compliance requirement under this regulation.","NIS2 requires entities to implement policies on risk analysis and information system security, including ensuring cloud service configurations meet accepted security standards.","Running configuration assessment tools like ScubaGear mirrors the intent of this control—proactively testing cloud environments to surface exploitable weaknesses before attackers do.","Misconfigurations in cloud services function like unpatched flaws; SI-2 requires organizations to identify and correct such weaknesses in their information systems on a defined schedule.","Security misconfigurations are a category of technical vulnerability; this control requires organizations to systematically identify and remediate them before they are exploited.","This control directly mandates establishing and maintaining secure configurations for cloud platforms, which is precisely what ScubaGear and ScubaGoggles audit against CISA's baselines.","Many M365 and Google Workspace misconfigurations directly weaken authentication and access controls, and this CSF outcome requires those protections to be correctly configured and maintained.","published","2026-10-27T16:20:44.340511+00:00","2026-10-27T16:20:44.309+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fcisa-free-tools-to-detect-misconfigurations\u002F","cisa-offers-two-free-tools-to-detect-security-misconfigurations-in-microsoft-365-22d1b4","CISA Offers Two Free Tools to Detect Security Misconfigurations in Microsoft 365 and Google Workspace",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[49],{"slug":50,"name":51,"problem":52},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]