CISA and NIST release IR 8587 cloud identity guidance
Public Sector Action
Summary
Hide ▲
Show ▼
CISA and NIST released IR 8587 to guide federal agencies and cloud service providers on protecting tokens and assertions from forgery, theft, and misuse. The guidance targets SSO, federation, and API-based access, where compromised identity material can enable lateral movement into sensitive systems. The report is intended to harden cloud identity controls across government-operated and commercial cloud services.
Related Happenings
CISA election registration database hardening guidance for election offices
Defensive Guidance
H score39
First: 25.09.2026 15:39
Last: 25.09.2026 15:39
Sources 1
About this happening:
Election infrastructure guidance now prioritizes multi-factor authentication, network monitoring, and least-privilege access for voter registration databases, redu...
CISA election registration database hardening guidance for election offices
Defensive GuidanceAbout this happening: Election infrastructure guidance now prioritizes multi-factor authentication, network monitoring, and least-privilege access for voter registration databases, redu...
CISA and NIST issue cloud identity token guidance
Public Sector Action
H score35
First: 16.09.2026 17:00
Last: 16.09.2026 17:00
Sources 1
About this happening:
CISA and NIST issued final guidance for protecting cloud identity tokens and assertions, setting a federal cybersecurity baseline for federal agencies, cloud service...
CISA and NIST issue cloud identity token guidance
Public Sector ActionAbout this happening: CISA and NIST issued final guidance for protecting cloud identity tokens and assertions, setting a federal cybersecurity baseline for federal agencies, cloud service...
ShinyHunters and Helix passkey-themed Microsoft 365 account compromise campaign
Campaign
H score34
First: 11.09.2026 20:26
Last: 11.09.2026 20:26
Sources 1
About this happening:
A ShinyHunters- and Helix-linked campaign is using passkey and SSO-themed social engineering to compromise corporate Microsoft accounts, exposing Microsoft 3...
ShinyHunters and Helix passkey-themed Microsoft 365 account compromise campaign
CampaignAbout this happening: A ShinyHunters- and Helix-linked campaign is using passkey and SSO-themed social engineering to compromise corporate Microsoft accounts, exposing Microsoft 3...
ShinyHunters vishing and phishing campaign targeting healthcare and medical technology organizations
Campaign
H score34
First: 29.07.2026 20:54
Last: 29.07.2026 20:54
Sources 1
About this happening:
The ShinyHunters campaign is intensifying vishing and phishing attacks against healthcare and medical technology organizations, increasing the risk of SSO takeover...
ShinyHunters vishing and phishing campaign targeting healthcare and medical technology organizations
CampaignAbout this happening: The ShinyHunters campaign is intensifying vishing and phishing attacks against healthcare and medical technology organizations, increasing the risk of SSO takeover...
CISA recommends continuous secrets scanning and stronger key management after GitHub leak
Defensive Guidance
H score26
First: 13.07.2026 18:03
Last: 13.07.2026 18:03
Sources 1
About this happening:
CISA now recommends continuous secrets scanning and stronger key management after a contractor left internal credentials in a public GitHub repository for nearly *...
CISA recommends continuous secrets scanning and stronger key management after GitHub leak
Defensive GuidanceAbout this happening: CISA now recommends continuous secrets scanning and stronger key management after a contractor left internal credentials in a public GitHub repository for nearly *...
Timeline
-
15.09.2026 15:00 2 articles · 13d ago
CISA and NIST release IR 8587 for cloud identity token protection
Initial DisclosureCISA and NIST released IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers, to guide federal agencies and cloud service providers in defending identity tokens and assertions used for SSO, federation, and API access. The report expands on NIST SP 800-53 and IA-13 control and recommends stronger token issuance, verification, key management, and lifecycle controls after June 2025 technical exchanges, a January 2026 webinar, and meetings with cloud providers including Google, HashiCorp, IBM, Microsoft, Okta, OpenID Foundation, Oracle, Amazon Web Services, and Wiz.
Show sources
- CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse — www.cisa.gov — 15.09.2026 15:00
- CISA and NIST Release Guidelines to Protect Federal Cloud Identity Systems from Token Theft, Forgery, and Misuse — www.cisa.gov — 15.09.2026 15:00