Getting started with Vulnerability Management

Moraph resells, implements and runs Tenable for banks, credit unions and other financial institutions. Tenable scans your network, servers and endpoints on the schedule you set, using credentials so it sees missing patches and weak configurations rather than only open ports. Moraph keeps the scans healthy, triages the findings, routes them to the teams that fix them and reports progress, while your institution decides risk acceptances and remediation priorities.

What it is for

Most institutions own a scanner, but scans quietly fail when credentials expire, new subnets go unscanned, and reports with thousands of findings are emailed to teams who cannot tell which matter. Remediation is tracked in spreadsheets, accepted risks are never revisited, and when examiners or auditors ask how often the network is scanned and how quickly critical findings are fixed, the evidence has to be rebuilt by hand.

• Scans run without credentials or miss parts of the network without anyone noticing
• Findings arrive in large reports with no owner or priority
• Remediation and risk acceptances are tracked in spreadsheets
• Scan coverage and fix times are hard to evidence for examiners and the board

Who uses it

• Banks, credit unions and other financial institutions without a dedicated vulnerability team
• Information security officers who answer for the vulnerability management program
• IT infrastructure and server teams who apply the fixes
• IT risk and compliance staff who prepare evidence for examiners
• Internal audit reviewing scanning coverage and remediation

Before you start

• Your organization uses Vulnerability Management as a managed platform from Moraph, under an agreement that covers it.
• Licences for Tenable, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Vulnerability Management with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Vulnerability Management
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com