The recommended best practice is to create custom roles to enforce the principle of least privilege (PoLP). This security concept ensures that users are granted only the permissions essential to perform their job functions. CrowdStrike Falcon’s Role-Based Access Control (RBAC) feature is designed to facilitate this by allowing administrators to define granular permissions for different user groups. Aligning roles with specific organizational responsibilities minimizes the potential impact of a compromised account, reduces the risk of accidental misconfiguration, and enhances overall security posture by limiting the attack surface within the Falcon console.

A. Using shared accounts is a significant security risk as it eliminates individual accountability and non-repudiation, making it impossible to trace actions back to a specific person.

C. Multi-Factor Authentication (MFA) is a critical security control that should be enforced for all accounts, including read-only, to prevent unauthorized access and protect sensitive security data.

D. Assigning the "Administrator" role to all users directly violates the principle of least privilege, creating an unnecessarily large attack surface and increasing the risk of catastrophic errors.

1. CrowdStrike Falcon® Platform Documentation

Falcon for Administrators

"Managing roles and users." This guide details the process of creating custom roles to tailor permissions. It states

"To grant users the minimum permissions they need to do their jobs

you can create custom roles... This helps you follow the security principle of least privilege." This directly supports the creation of custom roles as a best practice.

2. NIST Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations

Section AC-6 "Least Privilege." This foundational cybersecurity standard mandates that organizations "employ the principle of least privilege

allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks." This validates the core concept behind option B.

3. Carnegie Mellon University

Software Engineering Institute

Role-Based Access Control (RBAC) and Role-Based Security

(CMU/SEI-97-TR-012). This technical report outlines the benefits of RBAC

including its ability to "facilitate the administration of security" by mapping roles to organizational functions

which directly aligns with the practice described in the correct answer. (DOI: https://doi.org/10.1184/R1/6583583.v1

Section 2.2).