NIST and CISA Release Token Protection Guidelines to Combat Identity Attacks

NIST and CISA have released a draft interagency report providing implementation guidance for protecting identity tokens and assertions from forgery, theft, and misuse. The report, IR 8587, addresses attack techniques demonstrated in recent high-profile breaches and offers practical recommendations for federal agencies and cloud service providers.

Why Token Protection Matters

Identity tokens and assertions are fundamental to modern authentication systems. When compromised, attackers can:

• Impersonate legitimate users without knowing passwords
• Bypass multi-factor authentication
• Move laterally across cloud environments
• Access sensitive data and systems undetected

Recent attacks have demonstrated sophisticated token theft and forgery techniques, making this guidance timely and critical.

Key Recommendations

The report outlines principles for both cloud service providers and consuming agencies:

• Secure by design: Build token protection into architecture from the start
• Key management: Enhanced controls for signing keys used to create tokens
• Token verification: Robust validation of token authenticity and integrity
• Life cycle controls: Proper token expiration, revocation, and rotation
• Continuous monitoring: Detection of anomalous token usage patterns

Architectural Guidance

IR 8587 provides detailed architectural considerations for:

• Identity providers: How to securely issue and manage tokens
• Authorization servers: Token validation and access control decisions
• Relying parties: Safe consumption of tokens from external sources
• Federation scenarios: Cross-organization token trust relationships

Alignment with NIST SP 800-53

The guidance builds on updates to NIST SP 800-53 (Release 5.1.1), the foundational security controls catalog. Organizations already implementing 800-53 can map the new token protection recommendations to existing control families.

Executive Order Response

The report was developed in coordination with CISA's Joint Cyber Defense Collaborative in response to Executive Order 14144, "Sustaining Select Efforts to Strengthen the Nation's Cybersecurity." This demonstrates continued federal focus on identity and access management security.

Public Comment Period

The draft report is open for public comment through January 30, 2026. NIST and CISA encourage feedback from industry practitioners, security researchers, and cloud service providers to refine the guidance before final publication.