This report provides implementation guidelines to help federal agencies and cloud service providers (CSPs) protect identity tokens, access tokens, and assertions from forgery, theft, and misuse. Building on updates to NIST SP 800-53 (Release 5.1.1), it outlines principles for CSPs and consuming agencies, details architectural considerations for identity providers and authorization servers, and recommends enhancements to key management, token verification, and life cycle controls. The report addresses threats demonstrated in recent high-profile attacks, emphasizes the importance of secure by design practices, configurability, interoperability, and continuous monitoring, and provides specific technical recommendations to safeguard single sign-on (SSO), federation, and application programming interface (API) access scenarios.
This report provides implementation guidelines to help federal agencies and cloud service providers (CSPs) protect identity tokens, access tokens, and assertions from forgery, theft, and misuse. Building on updates to NIST SP 800-53 (Release 5.1.1), it outlines principles for CSPs and consuming...
See full abstract
This report provides implementation guidelines to help federal agencies and cloud service providers (CSPs) protect identity tokens, access tokens, and assertions from forgery, theft, and misuse. Building on updates to NIST SP 800-53 (Release 5.1.1), it outlines principles for CSPs and consuming agencies, details architectural considerations for identity providers and authorization servers, and recommends enhancements to key management, token verification, and life cycle controls. The report addresses threats demonstrated in recent high-profile attacks, emphasizes the importance of secure by design practices, configurability, interoperability, and continuous monitoring, and provides specific technical recommendations to safeguard single sign-on (SSO), federation, and application programming interface (API) access scenarios.
Hide full abstract
