During an audit of your organization's CrowdStrike Identity Analyzer configuration, you find several policies related to cloud service access. Which of the following represents a misconfiguration that needs immediate remediation?

A policy that allows all users to create and delete resources in production environments is a critical misconfiguration. This configuration directly violates the principle of least privilege, which dictates that users should only have the minimum permissions necessary to perform their job functions. Granting such broad and destructive permissions to an entire user base creates an enormous attack surface and a high risk of accidental or malicious damage to critical systems. CrowdStrike's Identity Analyzer is specifically designed to identify these types of overly permissive policies as high-priority risks that require immediate remediation to prevent potential data breaches, service disruptions, or compliance violations.

A. Explicitly denying access for unauthorized roles is a recommended security best practice, strengthening access control by preventing unintended permissions.
B. Providing read-only access to analysts is a proper implementation of the principle of least privilege, granting necessary access without allowing modification.
D. Granting developers specific deployment permissions in a non-production (staging) environment is a standard, secure operational practice that enables development without risking production systems.

1. CrowdStrike Documentation, Falcon Cloud Security: The CrowdStrike Falcon platform's Identity Analyzer module is designed to detect and prioritize identity-based risks, including overly permissive access policies in cloud environments. A policy granting universal create/delete access in production would be flagged as a critical-severity finding. (Reference: CrowdStrike Falcon® Cloud Security, "Identity Analyzer" feature description and documentation on misconfiguration detection).

2. NIST Special Publication 800-53 (Rev. 5), Security and Privacy Controls for Information Systems and Organizations: This standard outlines fundamental security controls. The described misconfiguration in option C is a direct violation of control AC-6, "Least Privilege," which mandates that organizations "employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks." (See: NIST SP 800-53 Rev. 5, Access Control (AC) family, Control AC-6).

3. MIT OpenCourseWare, 6.857 Computer and Network Security, Fall 2017: University course materials on computer security consistently emphasize the principle of least privilege as a cornerstone of secure system design. Lecture notes on access control models explicitly warn against granting broad, powerful permissions (e.g., write, delete) to wide groups of users, especially in production environments, as it represents a fundamental security flaw. (See: MIT OCW 6.857, lectures on Access Control and Cloud Security).