CISA-NIST issue token security guidance
CISA and NIST published joint guidance for agencies and cloud providers on protecting authentication tokens and identity assertions from forgery and theft.
Sourcecisa.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
CISA and NIST released a final interagency report providing federal agencies and cloud service providers with implementation recommendations for protecting identity assertions, access tokens, and the cryptographic mechanisms underpinning modern authentication and authorization systems. The guidance addresses risks inherent in hybrid and multi-cloud environments, single sign-on, federation, and API-based access, where signed tokens and assertions are increasingly targeted by adversaries for forgery, theft, and misuse to enable lateral movement and unauthorized access to sensitive data.
The report updates an earlier public draft, incorporating feedback on token validation, secrets management, and detection at scale gathered through CISA's Joint Cyber Defense Collaborative with government and industry input. It builds on NIST SP 800-53 controls and supports Executive Order 14306 on secure software development, emphasizing Secure by Design architectural principles for interoperable defense across cloud environments.
This is a policy/guidance publication rather than a report of active exploitation or a specific vulnerability. There are no IOCs, CVEs, or named threat actors associated with this release. Defenders and cloud architects should review the recommendations to strengthen token validation, secrets management, and detection capabilities for token-based authentication schemes as part of ongoing identity and access management hardening.
Source reporting: https://www.cisa.gov/resources-tools/resources/protecting-tokens-and-assertions-forgery-theft-and-misuse-implementation-recommendations-agencies
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs