Skip to content

Moraph for clients

Sign in

Identity Access Management

Securing financial institutions with Moraph managed platforms

Understand how Moraph configures and runs identity, privileged access, endpoint, vulnerability, data loss prevention, archiving, awareness training and secure file transfer platforms for banks and broker-dealers, and what your institution still owns.

Practitioner2 hr 32 min13 lessonsFor Administrators, Implementation partnersCertificate of completion

Lesson plan (printable)

About this course

Moraph resells, implements and runs eight security platforms for financial institutions: Okta for identity, CyberArk for privileged access, CrowdStrike Falcon for endpoint detection and response, Tenable for vulnerability management, Forcepoint for data loss prevention, Smarsh for communication archiving, KnowBe4 for security awareness training and Kiteworks for secure file transfer. In each case the vendor runs the platform, Moraph configures and operates your use of it, and your institution keeps the policy, risk and people decisions. This course shows you where those lines fall and how to work them day to day.

You will learn how baselines, change requests and exception registers keep a managed platform under your control, what each platform does for a bank or broker-dealer, and how to handle alerts, incidents and examinations without blurring who decides. The course describes how Moraph's services are designed. Your own service agreement and the baseline your institution approved are the final word on your service.

What you’ll be able to do

  • Explain the three-party model of vendor, Moraph and your institution, and apply it to each of the eight security platforms
  • Use configuration baselines, change requests, named approvers and exception registers to keep control of a managed platform
  • Describe what Moraph does and does not do on the identity, privileged access, endpoint and vulnerability platforms
  • Describe how data loss prevention, secure file transfer, communication archiving and awareness training are run, and who decides on people and data
  • Decide who acts and who decides when an alert, incident or exception comes up on any of the platforms
  • Prepare evidence for internal audit and examiners without giving away control or sensitive data

Skills you’ll gain

  • Shared responsibility mapping
  • Change and exception control
  • Security platform governance
  • Incident decision-making
  • Examination evidence

Before you start

  • You have completed Working with Moraph managed platforms, or you already know how Moraph service agreements, the service portal and Moraph Support work.
  • You work in IT, information security, risk or compliance at a bank, credit union, broker-dealer or other financial institution, or you implement Moraph services for one.
  • You know the basics of your institution's information security program and risk assessment.
  • Recommended first: Working with Moraph managed platforms

Syllabus

3 modules · 8 readings · 1 practical exercise · 4 assessments

  1. Module 1How the managed security platforms are run

    1. Reading: Vendor, Moraph and your institutionReading · 10 min
    2. Reading: Baselines, changes and exceptionsReading · 12 min
    3. Assessment: Module 1 knowledge checkAssessment · 8 min

  2. Module 2Access and endpoint controls

    1. Reading: Identity and multi-factor authenticationReading · 12 min
    2. Reading: Privileged accessReading · 11 min
    3. Reading: Endpoints and vulnerabilitiesReading · 13 min
    4. Assessment: Module 2 knowledge checkAssessment · 8 min

  3. Module 3Data, records and evidence

    1. Reading: Protecting sensitive data in motionReading · 12 min
    2. Reading: Communication archiving and security awarenessReading · 12 min
    3. Reading: Incidents, evidence and examinationsReading · 11 min
    4. Practical exercise: Practical: map who acts and who decidesPractical exercise · 15 min
    5. Assessment: Module 3 knowledge checkAssessment · 8 min
    6. Assessment: Final assessmentAssessment · 20 min

What completion gives you

Complete every lesson and pass each assessment to complete the course. You then get a completion record in My learning, and a certificate of completion you can print or share, with a code anyone can check at academy.moraph.com/verify.

Completion is not certification

Course completion records and certificates of completion show that a person completed a Moraph Academy course. They are not a Moraph certification (which needs the certification exam), a professional license or an accreditation, and they do not authorize anyone to configure, operate, resell or support Moraph products on Moraph’s or anyone else’s behalf.

Course updates

  • Version 1 · · First version.