Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers
NIST and CISA publish final interagency report with implementation guidance for protecting tokens and assertions from forgery and misuse.
CISA released a final NIST/CISA interagency report guiding federal agencies and cloud service providers on protecting identity assertions, access tokens, and cryptographic mechanisms underlying modern authentication and authorization. It addresses forgery, theft, and misuse of signed tokens that adversaries use for lateral movement and data access in hybrid and multi-cloud, SSO, federation, and API-based environments. The final version updates token validation, secrets management, and detection-at-scale guidance gathered via the Joint Cyber Defense Collaborative, and supports Executive Order 14306 and Secure by Design principles.
- Final report updates public draft with token validation and secrets management feedback
- Targets federal agencies and cloud providers adopting hybrid and multi-cloud identity architectures
- Covers forgery, theft, and misuse of tokens used for lateral movement and data access
- Supports Executive Order 14306 secure software development practices and Secure by Design
From the original article
1 min read at cisa.govDeveloped by the National Institute of Standards and Technology (NIST) and CISA, this interagency report provides federal agencies and cloud service providers with guidelines to protect the identity assertions, access tokens, and cryptographic mechanisms that support modern authentication and authorization.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.