Keeping these tokens safe is critical for protecting against unauthorized access, and it’s the goal of a newly finalized publication from the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA).
The publication, entitled “Protecting Tokens and Assertions from Forgery, Theft, and Misuse,” provides implementation guidelines to help maintain the security of tokens, widely used in digital systems.
The publication responds to NIST’s tasking in Executive Order 14306 and builds on recent updates to Special Publication 800-53, NIST’s catalog of security and privacy tools, for the purpose of enhancing the security of tokens and token management.
While the document is primarily for federal agencies and the cloud service providers (CSPs) they work with, it can help any organization that handles identity tokens and related forms of identity assertions, said NIST Digital Identity Program Lead Ryan Galluzzo.
Protecting Tokens
“This publication provides implementation considerations for protecting tokens appropriately,” said Galluzzo, one of the publication’s authors. “Anyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.”
Many of the services we use online – from web-based email to data backup – are based in “the cloud,” which consists of remote computer servers that require authorization to access.
Tokens are a key part of the access management infrastructure at most major CSPs. They contain cryptographically protected information about a user that can end up used as part of authentication. They can also enable things such as single sign-on, which allows a user to use multiple applications without having to constantly reauthenticate. If you like the convenience of single sign-on, thank a token.
Tokens see wide use in other ways in digital infrastructure, and they are an important part of zero trust architectures.
Forged Token Attack
However, without proper protection, a bad actor can exploit tokens to break into sensitive systems. In one attack the report cites, foreign actors accessed agency email systems using forged tokens derived from a single stolen commercial signing key. The end result was attackers stole more than 60,000 emails from a single agency.
“This document consolidates insights from across the cybersecurity community to help improve our ability to protect government data, resources and systems from the evolving threats they face today,” Galluzzo said.
Click here for more on “Protecting Tokens and Assertions from Forgery, Theft, and Misuse.”