Today, organizations are turning to software-as-a-service (SaaS) applications for everything from finance and human capital management operations to constituent engagement strategies. With recent high-profile data breaches, vulnerabilities related to token management have come into the spotlight. Adopting token hygiene practices like these can boost security compliance standards, keeping sensitive customer data out of the hands of fraudsters. By identifying and removing unused tokens, enforcing app approval processes, and integrating token management into employee offboarding, businesses can effectively minimize their risk of security breaches.
It’s clear that we all need to stay on top of our token hygiene after some big headline-grabbing breaches have occurred. For example, Cloudflare’s Atlassian deployment was breached through unrotated API tokens and service account credentials. Earlier this year in January 2023, CircleCI experienced a breach. In this complex breach, threat actors were able to hijack session tokens by deploying information-stealing malware on an engineer’s personal laptop. These cases are important wake-up calls to understand what can happen when token management is done poorly.
The Role of Token Hygiene in Preventing Breaches
It’s far too common that token theft is the source of a SaaS security breach. For organizations, this means taking a disciplined approach to token hygiene in order to stay safe. A lone purchased or stolen token can compromise multi-factor authentication (MFA) and other fraud prevention techniques. This provides attackers an entry point to access sensitive information for multiple organizations of the impacted customers. As a result, organizations need to focus on keeping tabs on what tokens are doing by turning on logging and monitoring usage with all SaaS applications.
To make their security posture much better, organizations should be proactive in identifying these unused tokens they have lurking within their systems. This can mean deploying alerts or an automated burn/blacklist process to correlate usage patterns with tokens that are inactive, lost, or just abandoned. By regularly reviewing token utilization, security teams can help ensure the environment remains secure by only enabling those with a valid need. This practice lowers the risks associated with dormant tokens.
Additionally, bringing token management into employee offboarding processes is a must. It’s critically important to revoke tokens and access tokens quickly when employees leave or third-party applications retire. This is a necessary action that goes a long way in stopping unlawful entry. By implementing these practices, companies enhance their ability to protect themselves from future breaches.
Enforcing App Approval and Monitoring Token Activity
Organizations must implement app approval policies in order to develop a strong security infrastructure. This creates a strong security vetting process for any new SaaS integrations. Such controls help to make sure that only applications we trust get access to our sensitive data and resources. Taking this proactive approach helps to ensure unauthorized applications attempting to exploit token vulnerabilities find them far less likely to succeed.
Tracking all token activity is key to a safe SaaS landscape. Organizations can create logging and token monitoring features to track token usage across all their cloud and on-premises environments. This helps security teams to identify anomalies and potential threats in real-time, enabling them to respond quickly to suspicious activities.
Lessons Learned from Recent Breaches
As recent breaches show, effective token management strategies are absolutely vital. The Drift chatbot disaster highlighted risks that exist within the poorly secured third party applications that organizations use. It was wreaking havoc by harvesting OAuth tokens from popular third-party integrations, such as Salesforce and Google Workspace. These breaches affect more than just the immediate entity breached—they can have a domino effect through the connected client networks.
Together, the incidents with CircleCI and Cloudflare offer a perfect learning moment. We need to frequently change credentials and continuously track token utilization to be safe. Organizations need to make updating API tokens and service account credentials a priority. This action makes a potentially compromised token much less useful to any would-be attacker.