NIST and CISA Release Interagency Report on Protecting Tokens and Assertions from Forgery and Misuse

The National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA) have published a final interagency report titled "Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers." The report provides federal agencies and cloud service providers with guidelines to protect the identity assertions, access tokens, and cryptographic mechanisms that support modern authentication and authorization.

As agencies adopt hybrid and multi-cloud environments, single sign-on, federation, and API-based access increasingly depend on signed tokens and assertions. The report notes that adversaries may target these tokens for forgery, theft, and misuse to move laterally across enterprise networks and access sensitive data.

The final report updates the initial public draft and incorporates feedback on token validation, secrets management, and detection at scale. Input was gathered from government and industry experts through CISA's Joint Cyber Defense Collaborative. The report expands on NIST Special Publication Security and Privacy Controls for Information Systems and Organizations and supports Executive Order 14306 on secure software development practices. It provides architectural considerations and emphasizes the importance of Secure by Design principles for interoperable defense across cloud environments.