Network Access Control

Moraph resells, implements and runs Cisco Identity Services Engine (ISE) so that every device connecting to a wired port or wireless network in your hospital is identified and given only the access its role allows. Unknown devices, including medical devices plugged into a wall jack without going through clinical engineering, are placed in a restricted network until someone decides what they are. Moraph builds the policies with your network, security and clinical engineering teams, introduces enforcement in stages so patient care is not interrupted, and triages what ISE sees every day.

The problem it solves

Hospital networks carry infusion pumps, monitors, imaging systems, building controls, workstations and personal devices, often on the same switches. Many medical devices cannot run security software or authenticate in the usual way, and a device plugged into an open wall jack typically gets the same access as a workstation. Security teams cannot say with confidence what is connected, clinical engineering learns about new devices after they are in use, and nobody wants to be the one whose blocking rule takes down a monitor in a patient's room.

Who it’s for

• Network and infrastructure teams at hospitals and health systems
• Information security officers responsible for the Security Rule and network risk
• Clinical engineering and biomedical teams who own medical devices
• IT leaders who need network access control without adding headcount
• Facilities teams responsible for building and environmental systems on the network

1. DiscoverBefore anything is blocked, ISE runs in monitoring mode and profiles what connects to each switch port and wireless network, so you see the real population of devices.
2. Design policyAccess rules are designed with your teams by device type and owner: workstations and staff authenticate with 802.1X, and devices that cannot are identified by profile and allowed only what they need.
3. Enforce in stagesEnforcement is switched on location by location, starting with non-clinical areas, and only with sign-off for clinical areas, so problems surface where they cause least harm.
4. Contain and decideWhen an unknown device connects, ISE places it in a restricted network, Moraph triages it, and the device's owner decides whether it is allowed, classified or removed.

Device profiling

ISE identifies device types from network attributes, so pumps, monitors, printers and workstations are recognized without an agent.

Restricted network for unknown devices

Devices that do not match an approved group are placed in a restricted network by policy until someone decides what they are.

802.1X for staff and workstations

Managed workstations and staff devices authenticate with certificates or credentials from your identity systems.

Medical device access by profile

Devices that cannot authenticate are identified by profile and allowed only the systems they need, agreed with clinical engineering.

Staged enforcement

Moraph moves locations from monitoring to enforcement in agreed stages, with sign-off for clinical areas and a rollback plan for each stage.

Guest and personal devices

Visitors and personal devices are given internet-only access separate from clinical systems, through the guest flow your policy sets.

Posture checks

Where you license it, ISE checks managed workstations for required security settings before granting full access.

Segmentation

Device groups are kept to their own network segments or access rules, limiting what a compromised device can reach.

Context sharing

ISE shares device and session context with security tools such as your SIEM, firewalls and medical device security platform.

Daily triage

Moraph reviews quarantined devices, authentication failures and new profiles, and works them with clinical engineering and IT.

Exception register

Devices allowed outside the normal policy are recorded with their owner, reason, approver and end date.

Monthly service review

Each month Moraph reports on enforcement progress, devices contained and released, exceptions, changes and platform health.

Network engineer

Owns switches and wireless and approves changes that ISE depends on

Security officer

Owns access policy and exceptions and leads security incidents

Clinical engineering

Identifies medical devices, owns their inventory and signs off clinical enforcement

Service desk

Takes reports of devices that cannot connect and routes them

Moraph service team

Designs, runs and monitors ISE and triages what it sees

Auditor (read-only)

Reviews policy, exceptions and records without changing them

Switches and wireless controllers

Authentication, authorization and profiling data exchanged with your network equipment, configured under your change process.

Directory and identity provider

Staff and workstation identities checked against your directory and certificate services for 802.1X.

Medical device inventory

Reconciliation with clinical engineering's inventory or a medical device security platform, including Moraph's Medical Device Cybersecurity Hub.

Mobile device management

Compliance status from your MDM used in access decisions for managed phones and tablets.

SIEM

ISE logs and alerts sent to your security information and event management system.

Firewalls and security tools

Device and session context shared with firewalls and other tools that support Cisco's context-sharing interfaces.

Service desk

Triage and change tickets tracked in Moraph's service desk, with your ticketing system connected where agreed.

Single sign-on for administrators

ISE administrators sign in through your identity provider with multi-factor authentication, using named accounts.

Role-based administration

Administrative roles separate policy changes, device classification and read-only views.

Controlled Moraph access

Moraph engineers reach ISE through an access path your organization approves, within the scope and time it authorizes.

Audit trail

Administrative changes, releases and exceptions are logged with who made them and when, and sent to your SIEM.

Encryption and keys

Configuration backups and evidence Moraph holds for the service are encrypted with keys staff cannot use without explicit, time-bound authorization.

Data handled

ISE handles device and network identity data, not clinical records. Where your use involves protected health information, a business associate agreement is put in place first.

Nodes in your data centers

ISE runs on virtual or physical hosts in your data centers, operated by Moraph through an access path you approve.

Nodes in your cloud account

Where your design supports it, ISE nodes run in your own cloud account and are operated by Moraph.

Your existing deployment

Where you already run ISE, Moraph reviews the configuration and takes over operation, subject to Cisco's licence terms.

Alongside other Moraph services

Can be run with Moraph's Medical Device Cybersecurity Hub, so the device inventory and network access policy stay in step.

Assessment

We review your network design, switch and wireless capabilities, identity sources and device inventories, and agree the scope with your network, security and clinical engineering leads.

Platform build

ISE nodes are deployed and connected to your directory, identity provider, SIEM and network equipment in monitoring mode.

Discovery

ISE profiles what is connected while nothing is blocked, and the results are reconciled with your inventories.

Policy design

Device groups, access rules and the restricted network are designed with your teams and tested in a lab or pilot location.

Staged enforcement

Locations move to enforcement in agreed stages, non-clinical first, with clinical engineering sign-off and a rollback plan for every stage.

Operations handover

Daily triage, the exception register, the emergency release path and the monthly service review begin.

• Moraph is not the vendor. Cisco owns Identity Services Engine, and its own support commitments, roadmap, advisories and product defects apply.
• Licences are subject to Cisco's terms, and features such as posture checks depend on the licence tier you hold.
• Enforcement depends on your switches and wireless controllers supporting the required features; older equipment may need upgrading, which is your organization's decision and cost.
• Profiling identifies devices from network behavior and attributes and can be wrong or incomplete. Classification of medical devices is confirmed by clinical engineering.
• Decisions to restrict or release a device, especially in clinical areas, are your organization's. Moraph acts within the approvals and emergency path you set.
• The service controls network access; it does not patch, harden or replace medical devices, and it is not an endpoint protection product.
• Network access control reduces risk from unknown devices but does not on its own stop a compromised device that is allowed on the network.
• Security incidents and any patient safety decisions are led by your organization, with Moraph supporting on the access layer.

• Run ISE in monitoring mode in one building and review what it finds against your inventories
• Check that your switches and wireless controllers support the features the design needs
• Walk through the enforcement stage plan with your clinical engineering lead
• Agree the emergency release path for a clinical device before any enforcement
• Review the responsibilities table with your network, security and clinical engineering leads
• Ask for a sample triage record and monthly service review