Network Access Control

Principal workflows

• Discover: Before anything is blocked, ISE runs in monitoring mode and profiles what connects to each switch port and wireless network, so you see the real population of devices.
• Design policy: Access rules are designed with your teams by device type and owner: workstations and staff authenticate with 802.1X, and devices that cannot are identified by profile and allowed only what they need.
• Enforce in stages: Enforcement is switched on location by location, starting with non-clinical areas, and only with sign-off for clinical areas, so problems surface where they cause least harm.
• Contain and decide: When an unknown device connects, ISE places it in a restricted network, Moraph triages it, and the device's owner decides whether it is allowed, classified or removed.

Who uses it

• Network and infrastructure teams at hospitals and health systems
• Information security officers responsible for the Security Rule and network risk
• Clinical engineering and biomedical teams who own medical devices
• IT leaders who need network access control without adding headcount
• Facilities teams responsible for building and environmental systems on the network

Reporting

• Quarantined devices and their triage status
• Connected devices compared with your inventories
• Unknown devices awaiting identification
• Enforcement coverage by location
• Exceptions with owners and end dates
• Monthly service review of containment, changes and health

Features

• Device profiling: ISE identifies device types from network attributes, so pumps, monitors, printers and workstations are recognized without an agent.
• Restricted network for unknown devices: Devices that do not match an approved group are placed in a restricted network by policy until someone decides what they are.
• 802.1X for staff and workstations: Managed workstations and staff devices authenticate with certificates or credentials from your identity systems.
• Medical device access by profile: Devices that cannot authenticate are identified by profile and allowed only the systems they need, agreed with clinical engineering.
• Staged enforcement: Moraph moves locations from monitoring to enforcement in agreed stages, with sign-off for clinical areas and a rollback plan for each stage.
• Guest and personal devices: Visitors and personal devices are given internet-only access separate from clinical systems, through the guest flow your policy sets.
• Posture checks: Where you license it, ISE checks managed workstations for required security settings before granting full access.
• Segmentation: Device groups are kept to their own network segments or access rules, limiting what a compromised device can reach.
• Context sharing: ISE shares device and session context with security tools such as your SIEM, firewalls and medical device security platform.
• Daily triage: Moraph reviews quarantined devices, authentication failures and new profiles, and works them with clinical engineering and IT.
• Exception register: Devices allowed outside the normal policy are recorded with their owner, reason, approver and end date.
• Monthly service review: Each month Moraph reports on enforcement progress, devices contained and released, exceptions, changes and platform health.

Integrations

• Switches and wireless controllers: Authentication, authorization and profiling data exchanged with your network equipment, configured under your change process.
• Directory and identity provider: Staff and workstation identities checked against your directory and certificate services for 802.1X.
• Medical device inventory: Reconciliation with clinical engineering's inventory or a medical device security platform, including Moraph's Medical Device Cybersecurity Hub.
• Mobile device management: Compliance status from your MDM used in access decisions for managed phones and tablets.
• SIEM: ISE logs and alerts sent to your security information and event management system.
• Firewalls and security tools: Device and session context shared with firewalls and other tools that support Cisco's context-sharing interfaces.
• Service desk: Triage and change tickets tracked in Moraph's service desk, with your ticketing system connected where agreed.

Deployment

• Nodes in your data centers: ISE runs on virtual or physical hosts in your data centers, operated by Moraph through an access path you approve.
• Nodes in your cloud account: Where your design supports it, ISE nodes run in your own cloud account and are operated by Moraph.
• Your existing deployment: Where you already run ISE, Moraph reviews the configuration and takes over operation, subject to Cisco's licence terms.
• Alongside other Moraph services: Can be run with Moraph's Medical Device Cybersecurity Hub, so the device inventory and network access policy stay in step.

Security and privacy

• Single sign-on for administrators: ISE administrators sign in through your identity provider with multi-factor authentication, using named accounts.
• Role-based administration: Administrative roles separate policy changes, device classification and read-only views.
• Controlled Moraph access: Moraph engineers reach ISE through an access path your organization approves, within the scope and time it authorizes.
• Audit trail: Administrative changes, releases and exceptions are logged with who made them and when, and sent to your SIEM.
• Encryption and keys: Configuration backups and evidence Moraph holds for the service are encrypted with keys staff cannot use without explicit, time-bound authorization.
• Data handled: ISE handles device and network identity data, not clinical records. Where your use involves protected health information, a business associate agreement is put in place first.

Limitations

• Moraph is not the vendor. Cisco owns Identity Services Engine, and its own support commitments, roadmap, advisories and product defects apply.
• Licences are subject to Cisco's terms, and features such as posture checks depend on the licence tier you hold.
• Enforcement depends on your switches and wireless controllers supporting the required features; older equipment may need upgrading, which is your organization's decision and cost.
• Profiling identifies devices from network behavior and attributes and can be wrong or incomplete. Classification of medical devices is confirmed by clinical engineering.
• Decisions to restrict or release a device, especially in clinical areas, are your organization's. Moraph acts within the approvals and emergency path you set.
• The service controls network access; it does not patch, harden or replace medical devices, and it is not an endpoint protection product.
• Network access control reduces risk from unknown devices but does not on its own stop a compromised device that is allowed on the network.
• Security incidents and any patient safety decisions are led by your organization, with Moraph supporting on the access layer.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/network-access-control. Purchasing routes and company information: www.moraph.com/how-to-buy.