NIST and CISA Finalize New Guidance to Protect Identity and Access Tokens from Forgery and Theft

NIST and CISA have finalized new guidance to help federal agencies and cloud service providers protect identity and access tokens from forgery, theft, and misuse, addressing weaknesses that have enabled recent high-profile intrusions involving forged tokens and stolen signing keys.

The publication, titled "Protecting Tokens and Assertions from Forgery, Theft, and Misuse" (NIST IR 8587), provides detailed implementation considerations for strengthening key management, token verification, and token lifecycle controls. It also outlines how identity providers and authorization servers should be designed, secured, and operated.

"This publication provides implementation considerations for protecting tokens appropriately," said Ryan Galluzzo, NIST Digital Identity Program Lead and one of the document's authors. He noted that the guidance applies to both government and commercial organizations using tokens as part of their access management infrastructure.

The guide focuses on tokens used to confirm who or what is requesting access and which resources they are allowed to use. These tokens underpin authentication, single sign-on (SSO), identity federation, API access, and workload-to-workload communication. They also support zero trust architectures by ensuring access is continuously verified.

Poorly protected tokens can give attackers direct access to sensitive systems. NIST cites a recent incident in which foreign actors used forged tokens created with a stolen commercial signing key to access government email accounts, stealing more than 60,000 messages from one agency.

NIST IR 8587 covers identity and access management systems that rely on digitally signed assertions and tokens based on asymmetric cryptography. The guidance emphasizes protecting cryptographic signing keys, limiting how those keys can be used, and ensuring tokens are properly verified before access is granted. It also addresses token lifetimes, revocation, session management, logging, and defenses against the reuse of stolen tokens.

Systems that do not rely on asymmetrically signed tokens are discussed where relevant but fall outside the main scope of the publication.

The guidance also defines shared responsibilities between cloud providers and their customers. Providers must secure the infrastructure they operate, including identity providers, authorization servers, and signing keys. They must issue tokens securely and offer customers robust configuration options. Customers, meanwhile, are responsible for configuring access policies, reviewing permissions, and using the security controls offered by their providers.

Some tasks require coordination, such as responding to compromised tokens or signing keys, sharing security signals, revoking access, and investigating incidents. Clearly defining these responsibilities helps reduce the risk of gaps that attackers could exploit.

NIST recommends that organizations collect detailed information about token use, monitor for signs of stolen or forged tokens, and maintain logs that support security monitoring and incident investigations. They should also track changes to access permissions and configurations and have procedures for responding when tokens or signing keys may have been compromised.

The publication includes considerations for AI agents, which use the same types of signed tokens to access email, files, APIs, and tools. NIST says organizations should apply token protections to AI agents but notes that agents introduce broader identity and access challenges that will require additional standards.

NIST also highlights the need to prepare for the transition to post-quantum cryptography (PQC). Organizations should understand where public-key cryptography is used in their identity systems and evaluate how future PQC algorithms may affect tokens, protocols, and applications.