Time to Contain

Account disablement

Account disablement turns off a user or service account in the identity provider so no new sign-in succeeds. It is blunt: the person loses access to everything. It is a common containment step for a compromised account, and risky for service accounts that other systems depend on.

Definition

Pair disablement with session revocation, since a disabled account can keep a live session. Check the platform does both.

Service accounts need a gate. Disabling the wrong one can stop payments or backups, which is a blast-radius problem more than a security one.

Account disablement in CrowdStrike Falcon Fusion's documentation

CrowdStrike's Falcon Fusion and Agentic SOAR pages name no disable-user action, and describe built-in connectors only as spanning identity, cloud, network, ITSM and collaboration tools. vendor claim crowdstrike.com, read

The example names a vendor and its own page. A vendor's use of Account disablement may differ from the definition above; the rubric uses the definition on this page.