CISA and NIST Issue Guidance to Protect Cloud Identity Tokens
CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.
CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.
- Tokens must be valid no more than one hour; expired tokens must be rejected
- Signing keys for high-impact systems rotate every 90 days in hardware-backed storage
- Every token requires an explicit audience field; tokens must never be logged
- Guidance follows 2020 ADFS SAML forgery and leaked signing key incidents
- Applies to AI agents using signed tokens, though broader AI access risks are out of scope
- Countries
- United States
From the original article
2 min read at infosecurity-magazine.com
CISA and NIST issued final guidance to help protect cloud identity tokens and assertions
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.