Cisa M365

🚀 CISA BOD 25-01 CSA MCP Implementation Guide

This project is a Red Team-based Minimum Capability Product (MCP) implementation of CISA BOD 25-01. Its goal is to assist organizations in meeting the requirements for cybersecurity audits, penetration testing, and remediation to achieve compliance with the CISA BOD 25-01 standard.

🚀 Quick Start

📦 Installation

1. Clone the repository:

git clone https://github.com/DynamicEndpoints/BOD-25-01-CSA-MCP.git
cd cisa-m365

2. Install dependencies:

npm install

3. Build the service:

npm run build

⚙️ Configuration

1. Create an Azure AD application:

   • Log in to the Azure Portal.
   • Navigate to Azure Active Directory.
   • Register a new application.
   • Add the required API permissions.
   • Create a client secret.

2. Configure environment variables:

cp .env.example .env

Edit the .env file:

TENANT_ID=your-tenant-id
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret

3. Configure MCP settings:

{
  "mcpServers": {
    "cisa-m365": {
      "command": "node",
      "args": ["path/to/cisa-m365/build/index.js"],
      "env": {
        "TENANT_ID": "your-tenant-id",
        "CLIENT_ID": "your-client-id",
        "CLIENT_SECRET": "your-client-secret"
      }
    }
  }
}

💻 Usage Examples

Available Tools

block_legacy_auth

Block the use of legacy authentication methods.

{}

block_high_risk_users

Block users identified as high-risk.

{}

enforce_phishing_resistant_mfa

Enforce phishing-resistant MFA for all users.

{}

configure_global_admins

Configure global administrator role assignments.

{
  "userIds": ["user1-id", "user2-id"]
}

get_policy_status

Get the current status of all security policies.

{}

Basic Usage

// Block legacy authentication
const result = await client.callTool('block_legacy_auth', {});

// Get policy status
const status = await client.callTool('get_policy_status', {});

📚 Documentation

API Reference

Policy Settings Interface

interface PolicySettings {
  legacyAuthentication: {
    blocked: boolean;
    compliant: boolean;
  };
  highRiskUsers: {
    blocked: boolean;
    compliant: boolean;
  };
  mfa: {
    phishingResistant: boolean;
    alternativeEnabled: boolean;
    compliant: boolean;
  };
  applications: {
    registrationRestricted: boolean;
    consentRestricted: boolean;
    compliant: boolean;
  };
  passwords: {
    expirationDisabled: boolean;
    compliant: boolean;
  };
  roles: {
    globalAdminCount: number;
    granularRolesEnforced: boolean;
    pamEnforced: boolean;
    compliant: boolean;
  };
}

Error Handling

This server implementation includes comprehensive error handling:

1. Authentication Errors

   • Token acquisition failure
   • Permission issues
   • Tenant configuration issues

2. Authorization Errors

   • Lack of necessary permissions
   • Incorrect request format
   • Exceeded rate limits

3. Policy Execution Errors

   • Policy parsing failure
   • Execution failure
   • Inability to apply fixes

4. General Errors

   • Invalid input data
   • Internal server errors
   • Unsupported operations

Testing Methods

1. Unit tests:

npm test

2. Integration tests:

npm run integration-test

3. Performance tests:

npm run benchmark

Security Considerations

• Encrypt all sensitive operations.
• Conduct regular security audits.
• Implement the principle of least privilege.

Contribution Guidelines

Contributions are welcome! Please refer to the Contributor Guidelines to learn how to participate.

📄 License

This project is licensed under the MIT License.

Appendix

Environment Variable Reference

TENANT_ID=your-tenant-id
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret

Tool Usage Examples

1. Use the block_legacy_auth tool:

npx cisa-mcp block_legacy_auth --tenantId yourTenantId

2. Use the enforce_phishing_resistant_mfa tool:

npx cisa-mcp enforce_phishing_resistant_mfa --tenantId yourTenantId

3. Check policy status:

npx cisa-mcp get_policy_status --tenantId yourTenantId

Frequently Asked Questions

1. How to handle authentication errors? Check if the tenant ID, client ID, and client secret are correctly configured.

2. Why can't I connect to Azure AD? Ensure network connectivity and check the application's API permission settings.

3. How to improve performance? Optimize query parameters and implement pagination and filtering features.