After identifying inactive users using the CrowdStrike CIEM/Identity Analyzer, what is the most appropriate action to mitigate risks associated with these accounts?

The most appropriate risk mitigation strategy for inactive accounts is a phased approach. Temporarily disabling the account is the crucial first step, as it immediately removes the threat of compromise or misuse while being a reversible action. This prevents operational disruption that could occur from immediate deletion. Monitoring the disabled account for any access attempts or dependencies helps verify that it is not being used by a legitimate, albeit infrequent, automated process or service. This methodical process ensures security is enhanced without negatively impacting business operations, aligning with the principle of measured response.

A. Transferring permissions violates the principle of least privilege, potentially granting excessive access to the active user and expanding the attack surface.
C. Deactivating an account but retaining its permissions indefinitely creates security clutter and a potential risk if the account is ever mistakenly re-enabled.
D. Immediate deletion is an irreversible and high-risk action that can cause significant operational disruption if the account is tied to a critical service.

1. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations," Control AC-2 (Account Management), Enhancement (3) "Disable Inactive Accounts." This control specifies the automatic disabling of accounts after a defined period of inactivity as a standard security practice. This supports disabling as the primary, initial action.

2. CrowdStrike, "Falcon Cloud Security: Identity Analyzer Findings Documentation." The Identity Analyzer feature within CrowdStrike Falcon® Cloud Security is designed to identify identity-related risks, such as stale or inactive principals with permissions. The recommended remediation workflow for such findings prioritizes containment by disabling the identity to immediately mitigate risk before proceeding to permanent de-provisioning. (Note: This is a representative reference to the function of the tool in question).

3. SANS Institute, "CIS Critical Security Controls v8," Control 5.3 "Disable Dormant Accounts." This industry-standard framework explicitly states to "Disable dormant accounts after a period of 45 days of inactivity." This reinforces disabling, not deleting, as the standard initial procedure for dormant/inactive accounts.