Lesson plan

Securing financial institutions with Moraph managed platforms

Understand how Moraph configures and runs identity, privileged access, endpoint, vulnerability, data loss prevention, archiving, awareness training and secure file transfer platforms for banks and broker-dealers, and what your institution still owns.

Back to the course

Product: Identity Access Management
Level: Practitioner
For: Administrators, Implementation partners
Total time: 2 hr 32 min
Lessons: 13 in 3 modules
Assessments: 4

Course objectives

Explain the three-party model of vendor, Moraph and your institution, and apply it to each of the eight security platforms
Use configuration baselines, change requests, named approvers and exception registers to keep control of a managed platform
Describe what Moraph does and does not do on the identity, privileged access, endpoint and vulnerability platforms
Describe how data loss prevention, secure file transfer, communication archiving and awareness training are run, and who decides on people and data
Decide who acts and who decides when an alert, incident or exception comes up on any of the platforms
Prepare evidence for internal audit and examiners without giving away control or sensitive data

Before the course

You have completed Working with Moraph managed platforms, or you already know how Moraph service agreements, the service portal and Moraph Support work.
You work in IT, information security, risk or compliance at a bank, credit union, broker-dealer or other financial institution, or you implement Moraph services for one.
You know the basics of your institution's information security program and risk assessment.

Module 1: How the managed security platforms are run (30 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Vendor, Moraph and your institution	Reading 10 min	Name the vendor platform behind each of Moraph's eight managed security services Explain what the vendor, Moraph and your institution each own in the three-party model Recognize decisions that stay with your institution whatever the service covers	Reading
Baselines, changes and exceptions	Reading 12 min	Explain what a configuration baseline is and why your institution approves it Follow a change request from request to approval to recorded change Record an exception with an owner, reason, compensating control and review date Describe how Moraph administrators are controlled inside your platforms	Reading
Module 1 knowledge check	Assessment 8 min	Check that you can apply the three-party model to a real decision Check that you know how baselines, changes and exceptions are controlled	5 questions · pass mark 70% · unlimited attempts

Module 2: Access and endpoint controls (44 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Identity and multi-factor authentication	Reading 12 min	Describe how Moraph builds and operates an Okta tenant for a financial institution Explain how authentication requirements follow the risk assessment and the FFIEC guidance Handle a leaver, an MFA exception and an escalated sign-in event correctly	Reading
Privileged access	Reading 11 min	Explain how CyberArk vaulting, rotation, dual control and session recording protect privileged accounts Describe how accounts are discovered and onboarded in approved waves Decide how to handle a failed rotation and a vendor's request for access	Reading
Endpoints and vulnerabilities	Reading 13 min	Explain how the containment policy decides what Moraph analysts may do on your endpoints Describe how scans, triage, remediation and fix verification work in vulnerability management Separate what Moraph does from what your IT teams do after a detection or a finding	Reading
Module 2 knowledge check	Assessment 8 min	Check that you can apply the identity, privileged access, endpoint and vulnerability services to real situations Check that you know which actions belong to Moraph and which to your teams	5 questions · pass mark 70% · unlimited attempts

Module 3: Data, records and evidence (1 hr 18 min)

Lesson	Type and time	Learners will be able to	Activity and assessment
Protecting sensitive data in motion	Reading 12 min	Explain how DLP policies move from audit to block, and who approves each step Describe how secure file transfer replaces email for sensitive documents Protect the sensitive data inside DLP incidents and client folders from over-exposure	Reading
Communication archiving and security awareness	Reading 12 min	Explain how Smarsh capture, retention and supervision are run for a broker-dealer Respond correctly to a capture gap, a legal hold instruction and a new messaging channel Describe how phishing simulation and training campaigns are approved, run and reported	Reading
Incidents, evidence and examinations	Reading 11 min	Choose the right support severity for a problem on any of the security platforms Prepare evidence for an examination without giving examiners standing access Use the monthly service review to keep exceptions and open risks from becoming permanent	Reading
Practical: map who acts and who decides	Practical exercise 15 min	Apply the three-party model to a mixed set of events across the security platforms Draft the escalation and approval route for each event without changing any live system	Practical exercise with a checklist
Module 3 knowledge check	Assessment 8 min	Check that you can apply the data protection, archiving and awareness services to real situations Check that you know how to handle incidents and examination requests	5 questions · pass mark 70% · unlimited attempts
Final assessment	Assessment 20 min	Show that you can apply the three-party model across all eight managed security platforms Show sound judgment on changes, exceptions, incidents and evidence	12 of 18 questions · pass mark 80% · 3 attempts

Completing the course

Every lesson must be completed: reading lessons are marked complete by the learner, exercises when every checklist item is confirmed, and assessments only when passed. Completing the course issues a certificate of completion with a verification code.