Getting started with Endpoint Detection & Response

Moraph resells, implements and runs CrowdStrike Falcon as a managed service across teller workstations, back-office PCs and servers at banks, credit unions and other financial firms. Falcon watches every endpoint for malicious behavior and blocks known threats; Moraph's analysts, working follow-the-sun from our offices, triage detections, hunt for activity that slipped past, and contain affected machines under rules you approve. Your security lead decides on anything beyond those rules, and you keep a full record of each incident.

What it is for

Branch and back-office workstations run all day, connect to the core banking system and payment applications, and are a common way in for ransomware and credential theft. Most community and regional institutions cannot staff a security operations team around the clock, so endpoint alerts raised overnight or at weekends wait until someone is in. Agents are deployed but not every machine reports, prevention policies are left in detect-only mode, and nobody has time to hunt for activity that did not raise an alert. When an incident does happen, notification clocks start running before the facts are known.

• Endpoint alerts outside business hours wait until staff arrive
• Some workstations and servers have no working sensor, and nobody notices
• Prevention policies are left in detect-only mode for fear of disrupting branches
• Incident facts needed for regulatory notification are assembled under pressure

Who uses it

• Chief information security officers and information security officers at banks and credit unions
• IT leaders responsible for branch, teller and back-office workstations
• Risk and compliance leaders who answer for incident response and notification
• Infrastructure teams who run core banking, payment and file servers
• Internal audit and examiners, who need evidence of monitoring and response

Before you start

• Your organization uses Endpoint Detection & Response as a managed platform from Moraph, under an agreement that covers it.
• Licences for CrowdStrike, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Endpoint Detection & Response with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Endpoint Detection & Response
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com