Question

A financial services company federates its on-premises Active Directory to a cloud SaaS suite using SAML through an on-premises identity provider (IdP). The security architect learns that a compromised token-signing certificate could allow an attacker to forge assertions for any user, including administrators, without triggering authentication logs at the IdP. Which design change most directly reduces the impact of a forged-assertion (golden SAML) attack against the SaaS environment?

Accepted Answer

Enforce conditional access policies at the SaaS service provider that require compliant, managed devices and re-evaluate risk signals independently of the incoming assertion

Answer

Increase the SAML assertion lifetime so tokens are reissued less frequently, reducing exposure of the signing operation

Answer

Migrate all users to longer, complex passwords and enforce 90-day rotation on the AD accounts

Answer

Enable verbose SAML request logging on the on-premises IdP and forward it to the SIEM