NIST strengthens safeguards for SSO and API tokens

The US National Institute of Standards and Technology (NIST) has finalized new guidance aimed at strengthening security for single sign-on (SSO), cloud federation and API access. The updated guidance, released on September 15, focuses on protecting identity tokens, access tokens and assertions used by federal agencies and cloud service providers.

The report, NIST Interagency Report 8587, recommends stronger controls for cryptographic signing keys, including secure storage, protected use and automated rotation. It also emphasizes the need for proper validation, scoping and revocation of tokens. Workload identities receive expanded treatment, with NIST recommending the use of short-lived tokens for software workloads.

Organisations are encouraged to implement secure defaults, strong key protection, configurability and monitoring for token-based access systems. The guidance applies to both providers and customers, with cloud providers expected to design secure services and consuming organisations responsible for configuring and maintaining controls. NIST received over 250 comments from various contributors, leading to changes in key protection, validity periods, workload identities and references to standards and protocols.