CISA Finalizes Microsoft 365 Secure Configuration Baselines

When CISA initiated its Secure Cloud Business Applications project, our goal was to elevate the federal government's baseline for email and cloud environments by optimizing the security capabilities available within widely used products and services while enabling operational visibility at the enterprise-level in support of our shared cybersecurity mission.
Today, we are pleased to announce the release of Version 1.0 of CISA's Secure Configuration Baselines for Microsoft 365 along with our ScubaGear tool.
These baselines provide easily adoptable policy configuration recommendations that complement each agency's unique requirements and risk tolerance levels.
These final Baselines have been refined and improved through extensive engagement with partners and from experiences gained from on-the-ground implementation efforts with agencies.
In October 2022, CISA released the draft M365 Secure Configuration Baselines for public comment and received hundreds of responses from public and private sector partners.
In parallel, we conducted a dozen pilot projects at federal agencies to target the adoption of advanced cloud security practices while testing our guidance and recommended configurations in practice.
These pilots demonstrated not only how critical these configuration baselines are to enhancing cybersecurity, but also how valuable it is to have comprehensive guidance to drive cross-organizational adoption in line with enterprise risk management.
Our pilot effort also reinforced how simple the ScubaGear tool is to use, and provided insight into agency resource needs for full adoption.
All participating agency teams were able to adopt a higher security baseline for their M365 email and cloud environments with existing resources- expertise they already had available.
Though these results may vary across organizations, applying the M365 Secure Configuration Baselines is not only essential in this cyber threat environment, but it is a relatively low level of effort for most cyber teams.
In support of our pilot efforts, CISA also released our assessment tool, ScubaGear, to help organizations rapidly assess their M365 services against CISA's recommended policies.
Since launch, ScubaGear has been downloaded over 4,000 times and its results, coupled with our SCuBA Baselines, have helped countless agencies and organizations take meaningful steps forward to elevate their cybersecurity posture.
Based on agency feedback, expert insight, Microsoft product updates, and extensive collaboration from Microsoft and other partners, Version 1.0 of the M365 Secure Configuration Baselines incorporates over 100 modifications to the initial draft.
While the final M365 baselines differ from the draft in meaningful ways, a few key improvements are of note.
Combined SharePoint and OneDrive: To improve usability and functional convenience, we integrated the baselines for SharePoint and OneDrive into one.
Optimized Baselines for Assessment Purposes: Our pilot experience illustrated the need for improved categorization and verification potential to facilitate assessments and implementation planning.
These changes clarified the intent of the baselines, streamlined their implementation, and directly improved the ScubaGear tool.
Focus on Practical Application and Communication: In order to drive progress and adopt an elevated baseline, practitioners and managers need to coordinate.
Where possible, CISA also provided information on the business impact of specific controls to support decision-making.
CISA deliberately designed Project SCuBA to be collaborative, inclusive, and public.


This Cyber News was published on www.cisa.gov. Publication date: Thu, 21 Dec 2023 19:43:05 +0000


Cyber News related to CISA Finalizes Microsoft 365 Secure Configuration Baselines

CISA Finalizes Microsoft 365 Secure Configuration Baselines - When CISA initiated its Secure Cloud Business Applications project, our goal was to elevate the federal government's baseline for email and cloud environments by optimizing the security capabilities available within widely used products and services ...
10 months ago Cisa.gov
CISA Seeks Public Comment on Newly Developed Secure Configuration Baselines for Google Workspace - As federal civilian agencies continue to modernize IT enterprises, increased reliance on cloud services, platform services, and external providers has introduced new types of risks. Recent threat activity from groups such as Storm-0558 have ...
10 months ago Cisa.gov
CISA Asks on Google Workspace Secure Configuration Baselines - In a groundbreaking stride towards fortifying cloud security, the Cybersecurity and Infrastructure Security Agency unveils the Secure Cloud Business Applications Google Workspace Secure Configuration Baselines. This architectural marvel establishes a ...
10 months ago Gbhackers.com
CISA Seeks Public Opinion on Google Workspace Secure Configuration Baselines - The US cybersecurity agency CISA on Tuesday released draft guidance and capabilities for federal agencies to securely use Google Workspace services. The proposed materials, for which CISA is seeking public comment, include Secure Cloud Business ...
10 months ago Securityweek.com
CISA Unveils Tools to Strengthen Google Cloud Services - As organizations continue their migration to the cloud, threat groups are not far behind. According to a report earlier this year from cybersecurity firm CrowdStrike, the number of attacks against cloud environments in 2022 jumped 95% year-over-year, ...
10 months ago Securityboulevard.com
CISA Releases Microsoft 365 Secure Configuration Baselines and SCuBAGear Tool - CISA has published the finalized Microsoft 365 Secure Configuration Baselines, designed to bolster the security and resilience of organizations' Microsoft 365 cloud services. This guidance release is accompanied by the updated SCuBAGear tool that ...
10 months ago Cisa.gov
CISA Releases SCuBA Google Workspace Secure Configuration Baselines for Public Comment - Today, CISA released the draft Secure Cloud Business Applications Google Workspace Secure Configuration Baselines and the associated assessment tool ScubaGoggles for public comment. The ScubaGoggles tool assesses GWS tenants' compliance against the ...
10 months ago Cisa.gov
Veeam adds BaaS capabilities for Veeam Backup for Microsoft 365 - Veeam Software has expanded its relationship with Microsoft. Veeam is making it easier for customers to protect Microsoft 365 with Cirrus by Veeam which brings the ease and flexibility of Backup-as-a-Service for Microsoft 365. Utilizing the power and ...
10 months ago Helpnetsecurity.com
CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
5 months ago Securityaffairs.com
Microsoft Incident Response lessons on preventing cloud identity compromise - Microsoft Incident Response is often engaged in cases where organizations have lost control of their Microsoft Entra ID tenant, due to a combination of misconfiguration, administrative oversight, exclusions to security policies, or insufficient ...
11 months ago Microsoft.com
New Microsoft Incident Response guides help security teams analyze suspicious activity - Today Microsoft Incident Response are proud to introduce two one-page guides to help security teams investigate suspicious activity in Microsoft 365 and Microsoft Entra. These guides contain the artifacts that Microsoft Incident Response hunts for ...
9 months ago Microsoft.com
CISA pledges to resolve issues with threat sharing system after watchdog report - On Friday, the Department of Homeland Security’s Office of the Inspector General published a report on Automated Indicator Sharing (AIS) — which was used to spread cyber threat intelligence and was mandated as part of a 2015 law. The nation’s ...
1 month ago Therecord.media
Microsoft 365 To Block Downloaded Excel XLL Add-Ins To Boost Security - Microsoft has recently announced that in order to help improve security, Microsoft 365 is now blocking the download of XLL add-ins for Excel on both Window PCs and Apple Macs. This new feature will be put into effect early 2021, affecting both Office ...
1 year ago Bleepingcomputer.com
​​Microsoft named as a Leader in three IDC MarketScapes for Modern Endpoint Security 2024 - With these security concerns top of mind, there is no surprise that in the last five years, the Modern Endpoint Security market has nearly tripled in size to defend against emerging, sophisticated, and persistent threats. Microsoft Defender for ...
7 months ago Techcommunity.microsoft.com
Microsoft fixes Outlook Desktop crashes when sending emails - Microsoft has fixed a known issue causing Outlook Desktop clients to crash when sending emails from Outlook.com accounts. These problems were first reported on Microsoft's community website and other social networks by customers saying they were ...
11 months ago Bleepingcomputer.com
Enabling Threat-Informed Cybersecurity: Evolving CISA's Approach to Cyber Threat Information Sharing - One of CISA's most important and enduring roles is providing timely and actionable cybersecurity information to our partners across the country. Nearly a decade ago, CISA stood up our Automated Indicator Sharing, or AIS, program to widely exchange ...
10 months ago Cisa.gov
CISA's OT Attack Response Team Understaffed: GAO - The US Government Accountability Office has conducted a study focusing on the operational technology cybersecurity products and services offered by CISA and found that some of the security agency's teams are understaffed. OT environments continue to ...
7 months ago Securityweek.com
CISA Warns of Compromised Microsoft Accounts - CISA issued a fresh CISA emergency directive in early April instructing U.S. federal agencies to mitigate risks stemming from the breach of numerous Microsoft corporate email accounts by the Russian APT29 hacking group. The directive is known as ...
6 months ago Securityboulevard.com
Microsoft deprecates Defender Application Guard for Office - Microsoft is deprecating Defender Application Guard for Office and the Windows Security Isolation APIs, and it recommends Defender for Endpoint attack surface reduction rules, Protected View, and Windows Defender Application Control as an ...
11 months ago Bleepingcomputer.com
Cybersecurity Performance Goals: Assessing How CPGs Help Organizations Reduce Cyber Risk - In October 2022, CISA released the Cybersecurity Performance Goals to help organizations of all sizes and at all levels of cyber maturity become confident in their cybersecurity posture and reduce business risk. Earlier this summer, CISA outlined ...
11 months ago Cisa.gov
CISA orders agencies impacted by Microsoft hack to mitigate risks - CISA has issued a new emergency directive ordering U.S. federal agencies to address risks resulting from the breach of multiple Microsoft corporate email accounts by the Russian APT29 hacking group. It requires them to investigate potentially ...
6 months ago Bleepingcomputer.com
Securing Tomorrow: A Recap of CISA's Cyber Resilient 911 Symposium - CISA's Emergency Communications Division spearheaded the Cyber Resilient 911 Program's fourth regional symposium, which included CISA Regions 5 and 7. Among the attendees were state 911 administrators, representatives from 911 centers, IT/cyber ...
5 months ago Cisa.gov
CISA confirms compromise of its Ivanti systems - CISA confirmed two of its internal systems were breached by a threat actor that exploited flaws in Ivanti products used by the U.S. cybersecurity agency. Ivanti on Jan. 10 disclosed two zero-day vulnerabilities that were under exploitation by a ...
7 months ago Techtarget.com
Microsoft Services Down: Xbox, Azure, Teams, Office 365 Experiencing Technical Difficulties - Microsoft services including Xbox, Azure and Office 365 are reportedly down. Several Microsoft users have started to complain about technical difficulties online. Many of them have mentioned that they can no longer sign in to Xbox and other Microsoft ...
1 year ago Hackread.com
CISA reveals how fed agency succumbed to ColdFusion attacks The Register - CISA has released details about a federal agency that recently had at least two public-facing servers compromised by attackers exploiting a critical Adobe ColdFusion vulnerability. The vulnerability, tracked as CVE-2023-26360, was disclosed in March ...
11 months ago Go.theregister.com

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)