How to Streamline Zero Trust Using the Shared Signals Framework

The problem – IAM tools don’t support SSF

Many organizations struggle to implement Zero Trust due to a lack of reliable signal sharing between security tools; 88% report significant implementation challenges according to Accenture. This impacts real-time access decisions when products are unable to communicate effectively.

Why This Matters

Current security architectures often rely on disparate systems that don’t natively interoperate. The Shared Signals Framework (SSF) aims to address this by standardizing security event exchange, but adoption remains inconsistent. Without interoperability, consistent policy enforcement is difficult, and critical security events, like device compliance issues from tools like Kolide Device Trust, may not reach identity providers like Okta.

Key Insights

• SSF aims to standardize security event exchange: This reduces reliance on proprietary integrations.
• Tines acts as an SSF transmitter: It converts Kolide device issues into CAEP events for Okta.
• SETs (Security Event Tokens) are crucial for SSF: They are signed JSON Web Tokens used to verify the authenticity of security events.

Working Example

# Example of building a CAEP event (simplified)
caep_event = {
    "event_type": "DeviceComplianceChange",
    "device_id": "device123",
    "user_id": "user456",
    "compliance_status": "non_compliant",
    "reason": "Outdated OS"
}

# (In Tines workflow, this would be signed with the RSA private key)
# signed_token = jwt.sign(caep_event, private_key, algorithm="RS256")

# Then sent to Okta's security-events endpoint
# requests.post(okta_security_events_url, headers={"Authorization": "SSWS " + api_token}, json={"set": signed_token})

Practical Applications

• MongoDB: Uses the Tines workflow to integrate Kolide Device Trust with Okta, enabling real-time enforcement of Zero Trust policies based on device compliance.
• Pitfall: Relying solely on native SSF support in all tools can lead to delays and gaps in security visibility; a flexible integration layer like Tines is critical.

References:

• https://thehackernews.com/2025/12/how-to-streamline-zero-trust-using.html