CISA and NIST Issue Guidance to Protect Cloud Identity Tokens
CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.
CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.