Source: The Red Canary Blog: Information Security Insights
Author: Nick Weber
URL: https://redcanary.com/blog/security-operations/saas-session-integrity/
ONE SENTENCE SUMMARY:
Strong MFA secures login, but portable SSO sessions remain hijackable; continuous session validation mitigates cookie and token replay attacks.
MAIN POINTS:
- Confusing secure authentication with secure access creates a dangerous post-login blind spot.
- FIDO2, device trust, UEBA, and conditional access harden the IdP login “front door.”
- SAML assertions or OIDC tokens are handed to service providers to enable SSO.
- Service providers mint session cookies after validation, ending IdP involvement.
- Stolen session cookies grant access because possession effectively equals authentication.
- Information-stealer malware commonly exfiltrates browser cookie jars from compromised endpoints.
- Device-bound IdP sessions don’t automatically bind downstream SaaS sessions like AWS or Salesforce.
- HTTP and federation standards make bearer cookies/tokens portable by design, limiting native defenses.
- DPoP/token binding can reduce replay risk, but SaaS support remains sparse.
- Defense-in-depth requires shorter TTLs, IP pinning, anomaly detection, and real-time session revocation.
TAKEAWAYS:
- Treat session integrity as a separate control plane from login assurance.
- Reduce attacker dwell time by tightening service-provider session lifetimes for critical apps.
- Constrain replay usefulness by forcing application access through VPN/SSE-controlled IP ranges.
- Detect hijacks by correlating IdP “known good” IPs with service-provider session telemetry in a SIEM.
- Prioritize vendors implementing Shared Signals Framework for continuous access evaluation and rapid session revocation.