NIST, CISA Finalize Playbook to Stop Token Theft

Securing Identity Tokens Against Theft and Forgery

The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have released finalized guidelines to help federal agencies and cloud service providers (CSPs) defend against the forgery, theft, and misuse of identity tokens. The publication, titled Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), offers a comprehensive framework for strengthening key management, token verification processes, and lifecycle controls. It also details how identity providers and authorization servers should be architected and managed to ensure robust security.

“This publication provides implementation considerations for protecting tokens appropriately,” said Ryan Galluzzo, NIST Digital Identity Program Lead and one of the publication’s authors. “Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.”

The Critical Role of Token Protection

Tokens serve as digital credentials that verify the identity of users or systems requesting access to specific resources. They are fundamental to modern digital infrastructure, enabling single sign-on (SSO) capabilities that allow users to access multiple applications without repeated authentication. Furthermore, tokens support zero trust security models by facilitating continuous verification before granting access.

However, weakly protected tokens present significant risks. Attackers can exploit compromised tokens to gain unauthorized entry into sensitive systems. NIST highlights a notable incident where foreign actors utilized forged tokens generated with a stolen commercial signing key to breach government email accounts, resulting in the theft of over 60,000 emails. This example underscores the necessity of rigorous protection measures for both the tokens themselves and the cryptographic keys used to sign them.

Key Management and Verification Strategies

NIST IR 8587 primarily addresses Identity and Access Management (IAM) systems that rely on digitally signed assertions and tokens based on asymmetric cryptography. These systems are essential for SSO, identity federation, API access, and workload authentication for automated services. The guidance emphasizes several core areas:

• Cryptographic Key Protection: Safeguarding the keys used to sign tokens and restricting their usage scope.While the guidance briefly touches on systems not using asymmetrically signed assertions, its primary focus remains on those leveraging these advanced cryptographic methods.

Shared Responsibilities Between Providers and Customers

The framework delineates distinct responsibilities for cloud providers and their customers to minimize security gaps. Cloud providers must secure the underlying infrastructure, including identity providers and authorization servers. Their duties include protecting signing keys, issuing tokens securely, and offering customers appropriate security features and configuration options.

Conversely, customers are responsible for configuring these services effectively, managing access policies, reviewing permissions, and utilizing the available security controls. Certain tasks require collaboration between both parties, such as responding to compromised tokens, sharing security signals, revoking access, and conducting incident investigations. Clear definition of these roles helps reduce ambiguity and enhances overall security posture.

Monitoring and Incident Response

Organizations are advised to collect detailed information about token usage to identify activity indicative of stolen credentials or unauthorized access. Maintaining comprehensive logs supports security monitoring and aids in incident investigations. Entities should monitor changes to access permissions and configurations closely. Having established procedures for responding to potential compromises of tokens or signing keys enables organizations to detect misuse quickly and determine which accounts, applications, or resources were affected.

Preparing for AI Agents and Post-Quantum Cryptography

As AI agents increasingly utilize signed tokens to access email, files, APIs, and other systems, NIST recommends applying these token protections to agent-based interactions. However, the guide acknowledges that AI agents introduce broader identity and access challenges not fully covered here, indicating a need for additional future standards.

Additionally, NIST has integrated considerations for the transition to post-quantum cryptography (PQC). Organizations are encouraged to identify where public-key cryptography is currently used within their identity systems. Understanding the impact of migrating to post-quantum algorithms on tokens, protocols, and applications is crucial for maintaining security in the face of evolving computational threats.