El NIST (National Institute of Standards and Technology<\/i> o Instituto Nacional de Est\u00e1ndares y Tecnolog\u00eda) es una agencia del Departamento de Comercio de Estados Unidos que crea normas y gu\u00edas t\u00e9cnicas para la ciencia, la industria y la tecnolog\u00eda. Un informe recientemente finalizado puede ayudar a los proveedores de servicios en la nube y a sus clientes a proteger mejor la identidad y los tokens de acceso, que se utilizan ampliamente al acceder a aplicaciones en l\u00ednea. En manos de un adversario, los tokens pueden ser peligrosos, y esta publicaci\u00f3n est\u00e1 dise\u00f1ada para ayudar a las organizaciones a tomar medidas efectivas para evitar exponerlos a los atacantes.<\/p>\n
\n
When you sign in to an online service like webmail, behind the scenes is often a token \u2014 a snippet of information identifying you and what online resources you are permitted to use, such as your inbox, contacts or other potentially sensitive information. Keeping these tokens safe is critical for protecting against unauthorized access, and it\u2019s the goal of a newly finalized publication from the National Institute of Standards and Technology (NIST) and the Cybersecurity and Infrastructure Security Agency (CISA).<\/p>\n
The publication, whose full title is\u00a0Protecting Tokens and Assertions from Forgery, Theft, and Misuse<\/em>\u00a0(NIST IR 8587)<\/a>, provides implementation guidelines to help maintain the security of tokens, which are widely used in digital systems. The publication responds to NIST\u2019s tasking in\u00a0Executive Order 14306<\/a>\u00a0and builds on recent updates to\u00a0Special Publication 800-53<\/a>, NIST\u2019s catalog of security and privacy tools, for the purpose of enhancing the security of tokens and token management.<\/p>\n While the document is primarily written for federal agencies and the cloud service providers (CSPs) they work with, it can help any organization that handles identity tokens and related forms of identity assertions, said NIST Digital Identity Program Lead Ryan Galluzzo.<\/p>\n \u201cThis publication provides implementation considerations for protecting tokens appropriately,\u201d said Galluzzo, one of the publication\u2019s authors. \u201cAnyone who is using tokens as part of their access management infrastructure can look to this for insights, whether they are in government or commercial industry.\u201d<\/p>\n Many of the services we use online \u2014 from web-based email to data backup \u2014 are based in \u201cthe cloud,\u201d which is made up of remote computer servers that require authorization to access. Tokens are a key part of the access management infrastructure at most major CSPs. They contain cryptographically protected information about a user that can be used as part of authentication. They can also enable things such as single sign-on, which allows a user to use multiple applications without having to constantly reauthenticate. If you like the convenience of single sign-on, thank a token.<\/p>\n Tokens are widely used in many other ways in digital infrastructure, and they are an important part of\u00a0zero trust architectures<\/a>. However, without proper protection, a bad actor can exploit tokens to break into sensitive systems. In\u00a0one attack<\/a>\u00a0the report cites, foreign actors accessed agency email systems using forged tokens derived from a single stolen commercial signing key. The attackers stole more than 60,000 emails from a single agency.<\/p>\n The report\u2019s intended audience is both federal agencies, which need to understand how to configure services from their CSPs appropriately, and the CSPs themselves, which need to deliver secure products to these agencies. The publication lays out a set of principles for both parties, delineating what provider and consumer organizations should do to ensure that data remains protected.<\/p>\n Galluzzo said the authors revised the\u00a0initial draft<\/a>\u00a0of the publication in response to reader feedback. Among the most notable changes are:<\/p>\n Galluzzo highlighted the critical support NIST and CISA received from industry partners such as the Joint Cyber Defense Collaborative, which provided critical feedback.<\/p>\n \u201cThis document consolidates insights from across the cybersecurity community to help improve our ability to protect government data, resources and systems from the evolving threats they face today,\u201d he said.<\/p>\n\n