#tokentheft — Public Fediverse posts

Microsoft Entra ID Token Protection is a security feature within Microsoft Entra's Conditional Access that aims to mitigate token theft by ensuring that a token can only be used from the device it was issued to. This is achieved through a process called token binding, which creates a cryptographically secure link between the token and the device.

If a threat actor were to steal a token, without the corresponding client secret from the device, the token would be rendered useless.

This protection is particularly important because token theft, while relatively rare, can lead to significant security breaches if the threat actor impersonates the victim until the token expires or is revoked.

Do you want to learn more about token protection and how to enforce it in Microsoft Entra ID? Read my latest blog post! 👇👇

https://www.cswrld.com/2024/04/microsoft-entra-id-token-protection-explained/

#entraid #authentication #tokenprotection #tokentheft #conditionalaccess #cybersecurity #tips

Behind the Breach: Pass-The-Cookie Beyond IdPs – Source: securityboulevard.com https://ciso2ciso.com/behind-the-breach-pass-the-cookie-beyond-idps-source-securityboulevard-com-2/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #SecurityGuidance #Sessionhijacking #passthecookie #SaaSSecurity #Tokentheft #PTCattack #FEATURED

Behind the Breach: Pass-The-Cookie Beyond IdPs – Source: securityboulevard.com https://ciso2ciso.com/behind-the-breach-pass-the-cookie-beyond-idps-source-securityboulevard-com-2/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #SecurityGuidance #Sessionhijacking #passthecookie #SaaSSecurity #Tokentheft #PTCattack #FEATURED

Behind the Breach: Pass-The-Cookie Beyond IdPs – Source: securityboulevard.com https://ciso2ciso.com/behind-the-breach-pass-the-cookie-beyond-idps-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #SecurityGuidance #Sessionhijacking #passthecookie #SaaSSecurity #Tokentheft #PTCattack #FEATURED

Behind the Breach: Pass-The-Cookie Beyond IdPs – Source: securityboulevard.com https://ciso2ciso.com/behind-the-breach-pass-the-cookie-beyond-idps-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #SecurityGuidance #Sessionhijacking #passthecookie #SaaSSecurity #Tokentheft #PTCattack #FEATURED

I'd like to point out this really interesting article on the topic: 𝐓𝐨𝐤𝐞𝐧 𝐓𝐡𝐞𝐟𝐭 𝐓𝐚𝐥𝐤.

Key points and topics covered:

- Primary Refresh Tokens (PRT) on all operating system platforms have been hardened against theft from day one. The level of protection depends on operated system capabilities, with Windows offering the strongest protection.

- First line of defense against token theft is protecting your devices by deploying endpoint protections, device management, MFA (and moving towards phishing-resistant credentials), and antimalware

You can reduce token theft by carefully orchestrating Entra ID security products:

▶Addressing token theft of sign-in session artifacts: Conditional Access: Token protection policy offers cryptographic protection against replay of stolen tokens.

▶Addressing token theft of app session artifacts: block usage of stolen access tokens and workload cookies outside of your corporate network by using Conditional Access.

▶Detecting token theft: enable risk detections with Microsoft Entra ID Protection to elevate user risk when token theft is suspected.

https://techcommunity.microsoft.com/t5/microsoft-entra-blog/addressing-data-exfiltration-token-theft-talk/ba-p/3915337

#microsoft #microsoftsecurity #entraid #azuread #azure #idp #token #tokentheft #cloudsecurity #identity #prt #cookies #identityprotection #mfa #cae #conditionalaccess #refreshtoken #token