NIST and CISA Release Final Token Security Guidance to Prevent Forgery, Theft, and Misuse

The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have formally issued Protecting Tokens and Assertions from Forgery, Theft, and Misuse (NIST IR 8587), offering implementation guidelines to help maintain the security of tokens widely used in digital systems.

The document responds to NIST's tasking in Executive Order 14306 and builds on recent updates to Special Publication 800-53, NIST's catalog of security and privacy tools, to enhance the security of tokens and token management.

NIST Digital Identity Program Lead Ryan Galluzzo said that while the document is primarily written for federal agencies and the cloud service providers they work with, it can help any organization that handles identity tokens and related forms of identity assertions.

Galluzzo, one of the publication's authors, noted that the document provides implementation considerations for protecting tokens appropriately, offering insights for government and commercial industry alike.

When signing in to an online service like webmail, there is often a token behind the scenes—a piece of information identifying the user and the online resources they may access, such as inbox, contacts, or other potentially sensitive information. Keeping these tokens safe is critical for protecting against unauthorized access.

Tokens are widely used in cloud computing and zero trust architectures, and without proper protection, an attacker can exploit tokens to break into sensitive systems. The report cites one attack in which foreign actors accessed agency email systems using forged tokens derived from a single stolen commercial signing key, stealing more than 60,000 emails from a single agency.