CISA and NIST Issue Guidance to Protect Cloud Identity Tokens
CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.
CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.
- Tokens must be valid no more than one hour; expired tokens must be rejected
- Signing keys for high-impact systems rotate every 90 days in hardware-backed storage
- Every token requires an explicit audience field; tokens must never be logged
- Guidance follows 2020 ADFS SAML forgery and leaked signing key incidents
- Applies to AI agents using signed tokens, though broader AI access risks are out of scope
Full article464 words · extracted from infosecurity-magazine.com · click to collapse
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have issued final guidance for protecting cloud identity tokens and assertions from theft, forgery and misuse, aimed at federal agencies, cloud service providers and the organizations that buy from them.
Interagency Report 8587, published September 15, covers the tokens behind single sign-on (SSO), identity federation and application programming interface (API) access. The agencies said adversaries increasingly target them to move laterally and reach sensitive data.
Following the new guidance is voluntary.
What the Guidance Asks For
Access and identity tokens should be valid for no more than an hour, the report says, and expired tokens must be rejected outright by authorization services and policy enforcement points.
On key management, signing keys for high-impact systems should be rotated at least every 90 days, and within a year everywhere else. At moderate impact and above they must sit in hardware-backed or isolated storage, never persistently on the servers, virtual machines or containers using them. High-impact systems must also sign inside an isolated execution environment.
Keys must be scoped to the narrowest sensible boundary, and one valid outside a federally authorized environment must not sign tokens inside one.
Every token must carry an explicit audience field, and any access control mechanism receiving one without it must reject the token. Tokens themselves, and any personal data inside them, must never be written to logs.
The report notes AI agents increasingly use signed tokens to reach systems, data and APIs, and says the guidance applies there too. Wider AI agent access risks are excluded from its scope, and NIST and CISA said they are still developing guidelines for them.
Read more on identity security: Attackers Steal METR API Key and Burn $600,000 in AI Credits
Written After Two Token Compromises
The report traces the problem to two incidents. In a 2020 supply chain intrusion, attackers who had compromised Active Directory Federation Services forged SAML assertions to bypass multifactor authentication (MFA) at thousands of organizations, federal agencies among them.
In the second, foreign actors used a consumer signing key exposed by mistake, then forged tokens with it. Token validation failures let it produce valid signatures inside enterprise and government systems, and more than 60,000 emails were taken from one agency.
"Identity is the new perimeter, and the tokens and assertions behind it are attractive targets for sophisticated adversaries," said Chris Butera, CISA acting executive assistant director for cybersecurity. He said the guidelines offer a path to harden token issuance so a stolen credential cannot become a foothold across the federal enterprise.
CISA said nearly 250 public comments shaped the final text. Google, Microsoft, Okta, Amazon Web Services, Oracle, IBM, HashiCorp, Wiz and the OpenID Foundation fed in through its Joint Cyber Defense Collaborative.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-nist-cloud-identity-token/