csrc.nist.govpaperNIST IR 8587: Protecting Tokens and Assertions from Forgery, Theft, and Misuse
NIST IR 8587 is a finalized interagency report, developed with CISAs Joint Cyber Defense Collaborative under Executive Order 14306, giving federal agencies and cloud service providers implementation recommendations to protect identity tokens and assertions from forgery, theft, and misuse. It builds on NIST SP 800-53 Revision 5 to detail architectural guidance for identity providers and authorization servers, plus enhancements to key management, token verification, and token lifecycle controls covering SSO, federation, API, and workload access scenarios, informed by threats seen in recent high profile token theft attacks.
TL;DR NIST and CISAs final IR 8587 gives agencies and CSPs concrete controls to stop token and assertion forgery and theft across SSO, federation, API, and workload identity.
Organisations named here
- CISA
- Executive Order 14306
Technologies named here
- NIST SP 800-53 Revision 5
Techniques named here
- Token and assertion forgery
- Token theft
- Token/assertion misuse
Related in Identity & Access
huntress.comarticleEducation Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticleNext-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
