New US Guidance Targets Weak Links in Cloud Login Tokens

The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST) have published guidance aimed at protecting cloud identity tokens, the digital credentials that let users move between apps without logging in repeatedly. The guidance targets federal agencies and cloud providers, but the practices it recommends apply to any organisation using single sign-on or API access.

The report recommends short token lifespans of no more than an hour, strict rejection of expired tokens, and regular rotation of signing keys (at least every 90 days for high-impact systems). It also calls for keys to be stored in hardware-backed or isolated systems rather than left on the servers that use them, for tokens to clearly state which system they are meant for, and for tokens to never be written into logs where they could be exposed.

The guidance follows two real-world incidents where attackers forged authentication tokens to bypass multi-factor authentication and access sensitive systems, in one case stealing more than 60,000 emails from a government agency. While the guidance is voluntary and written for federal environments, it reflects growing recognition that stolen or forged login tokens, not just passwords, are becoming a primary route into cloud systems, including those used by AI tools.