Privileged Access Management

Principal workflows

• Discover and onboard: Moraph finds the privileged accounts across your core banking platform, servers, databases, network devices and cloud consoles, agrees an owner for each, and brings them into CyberArk in waves you approve.
• Request and use access: Administrators request a credential or a session through CyberArk. Where your policy requires it, a safe owner approves the request before access is granted, and the session is brokered and recorded.
• Rotate and verify: CyberArk changes and verifies passwords on the schedule your policy sets. Moraph watches for rotations that fail and works them with your system owners until the account is back under management.
• Monitor and evidence: Moraph watches platform health and CyberArk's security alerts, triages them with your security operations team, and produces the access reviews and reports your auditors and examiners expect.

Who uses it

• CISOs and information security officers at banks, credit unions and other financial institutions
• Infrastructure and core banking administrators who use privileged accounts every day
• IT risk and compliance teams who answer access findings
• Internal audit and examiners reviewing privileged access controls
• Institutions that own a CyberArk licence but have not finished rolling it out

Reporting

• Privileged accounts under management by system and owner
• Rotation and verification failures, open and resolved
• Access requests, approvals and rejections
• Session activity on the most sensitive accounts
• Safe membership certification results
• Changes applied to the platform configuration

Features

• Credential vaulting: CyberArk stores privileged passwords and keys in its encrypted vault, organized into safes with their own members and permissions.
• Automatic rotation: CyberArk changes and verifies passwords on the schedule set in each platform policy, so no administrator needs to know a standing password.
• Session isolation and recording: Administrator sessions to servers, databases and consoles are brokered through CyberArk and recorded, so the password never reaches the administrator's workstation.
• Dual control: For the accounts you choose, access requires a reason and an approval from a safe owner before CyberArk releases it.
• Account discovery: Moraph runs CyberArk discovery across your environment and reconciles the results with your inventories so unmanaged privileged accounts are found and onboarded.
• Application credentials: Where your applications and scripts use embedded passwords, CyberArk's credential provider lets them retrieve the credential at run time instead, onboarded by Moraph with your developers.
• Vendor and third-party access: Contractors and vendors reach the systems they support through CyberArk with time-limited, approved and recorded access, rather than standing VPN accounts.
• Policy baseline: Moraph documents the platform policies, safe design and approval rules that implement your access policy, and reviews the running configuration against that baseline.
• Rotation exception handling: Accounts whose password change or verification fails are worked by Moraph with the system owner until they are back under management, and tracked until then.
• Alert triage: CyberArk's security alerts, such as access outside the vault or unusual session activity, are triaged by Moraph and passed to your security team with the context needed to decide.
• Access reviews: Safe membership, approver lists and account owners exported for periodic certification, with the results and removals recorded.
• Change management: Every change to safes, policies and onboarding goes through a change request your team approves, tested in a non-production environment where one exists.

Integrations

• Identity provider: Administrators and approvers sign in to CyberArk through your identity provider with multi-factor authentication, and roles follow your directory groups.
• Core banking and infrastructure: CyberArk connects to the core banking platform's administrative accounts, Windows and Linux servers, databases, network devices and hypervisors to rotate and broker access, where the target system supports it.
• Cloud consoles: Administrative accounts and access keys for your cloud providers can be vaulted and rotated where the provider supports it.
• SIEM: CyberArk audit events and security alerts forwarded to your security information and event management system.
• IT service management: Access requests can require a valid ticket number from your service management tool, and Moraph's change requests reference your change records.
• Moraph service portal: Change requests, alerts, onboarding progress and monthly service reviews are tracked in Moraph's service portal, available to your team through single sign-on.
• Endpoint Detection & Response: Where you also use Moraph's managed endpoint service, privileged-session context can be shared with endpoint investigations.

Deployment

• CyberArk Privilege Cloud: The vault runs as CyberArk's software-as-a-service, with connectors in your environment, configured and operated by Moraph.
• Self-hosted: CyberArk components run in your data center or cloud account, installed and maintained by Moraph under your change process.
• Existing CyberArk estate: If you already own CyberArk, Moraph can take over operations of the existing deployment after a baseline review.

Security and privacy

• Single sign-on: Your staff sign in to CyberArk and to Moraph's service portal through your identity provider, so your password and multi-factor policies apply.
• Moraph staff access: Moraph engineers reach your CyberArk environment through role-based access you approve, with their own sessions recorded, and cannot retrieve your privileged passwords without explicit, time-bound authorization.
• Separation of duties: Safe design keeps vault administration separate from access to the credentials in the safes, so administering the platform does not mean seeing the passwords it holds.
• Complete audit trail: CyberArk logs every credential retrieval, session and configuration change, and Moraph's service portal logs every change request, approval and alert decision.
• Encryption: CyberArk encrypts the vault and its contents; Moraph's own service records are encrypted with keys staff cannot use without explicit, time-bound authorization.
• Audited operations: Moraph is SOC 2 Type II and ISO/IEC 27001 audited company-wide, and its service records are hosted in the United States, United Kingdom or Australia region you choose.

Limitations

• Moraph is not CyberArk. Moraph resells, implements and operates the platform; CyberArk develops it and is responsible for its software and cloud service.
• CyberArk's own service commitments, product roadmap and any outages of its cloud service apply. Moraph does not change them.
• Licences are subject to CyberArk's terms, which you accept as part of the purchase.
• Some systems cannot have passwords rotated automatically, for example older platforms without a supported connector. These are documented as exceptions with a compensating control your institution approves.
• Removing hard-coded credentials from applications needs your developers to change the application; Moraph identifies them and supports the change.
• Moraph does not decide who should hold privileged access. Your institution sets the policy and approves access and exceptions.
• Moraph triages alerts from the platform but does not replace your security operations center or incident response team.
• Session recordings are kept for the period your policy sets and the platform's storage allows; longer retention needs additional storage.

Next steps

Book a demonstration or a technical briefing at www.moraph.com/solutions/privileged-access-management. Purchasing routes and company information: www.moraph.com/how-to-buy.