csrc.nist.govpaperNIST IR 8587 (Final) — Protecting Tokens and Assertions from Forgery, Theft, and Misuse
NIST IR 8587 is a final NIST report giving federal agencies and cloud service providers implementation guidance for protecting identity tokens, access tokens, and assertions from forgery, theft, and misuse. It builds on NIST SP 800-53 (Release 5.1.1) with architectural recommendations for identity providers and authorization servers covering key management, token verification, and lifecycle controls, aimed at securing SSO, federation, and API access scenarios following recent high-profile token-forgery attacks.
TL;DR NIST's final guidance for hardening SSO/federation tokens and assertions against forgery and theft, building on SP 800-53.
Technologies named here
- Cloud service provider identity platforms
- NIST SP 800-53
Techniques named here
- Token/assertion forgery
- Token/assertion theft
- Token/assertion misuse
Related in Identity & Access
huntress.comarticleEducation Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticleNext-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
