City of Los Angeles

The City of Los Angeles is the second-largest city in the U.S., serving 3.9 million residents through more than 40 departments — from the Department of Aging to the Los Angeles Zoo. “Public websites are the face of the City of Los Angeles,” says Timothy Lee, the City’s Chief Information Security Officer (CISO). “They’re our brand. Residents and employees expect 100% availability and count on us to protect their personal information.”

In the past, most departments ran their own security operations center. But not having a centralized view of cyber incidents delayed awareness of new kinds of attacks. In 2014, the mayor formed a centralized group to coordinate cyber activities, appointing Lee, then CISO for the Port of Los Angeles, as the City’s first CISO. “I was hired to design and implement a single, coordinated cyber strategy,” Lee says. “An important part of that strategy is a unified view of cyber incidents across all departments and shared platforms as much as possible.”

Lee’s team set to the task of building an integrated security operations center (ISOC) serving 40+ departments. “The ISOC detects about 1 billion security events a day,” says Daniel Clark, IT Agency ISOC Manager for the City. A growing number of those events are “zero-day” exploits, targeting newly discovered vulnerabilities before vendors can update their code and system administrators can install the updates. “Securing all of the City’s public-facing websites with a WAF [web application firewall] is a key element of our cyber strategy,” Clark says. 

Lee and Clark concluded that the existing WAF came up short for serving many departments. Adding protections to new websites and fine-tuning rules was too time-consuming and cumbersome. Evaluating the top WAFs in the Gartner Magic Quadrant, Clark and Lee selected Akamai App & API Protector with Bot Manager. 

“Akamai protects our websites against zero-day threats,” Clark says. “It’s simple to set up. And it works with every department’s websites without a lot of customization.” Lee adds, “When I choose a partner, I look at more than technical features. The biggest difference between leading vendors is often their flexibility. Akamai agreed to work with us on a phased deployment to meet our timeline and budget constraints.”

During the cutover to Akamai, Clark and Lee engaged Akamai Professional Services to ensure a smooth transition — turning on Akamai as the previous WAF was decommissioned. “We had zero downtime when we switched from our old WAF to Akamai and received excellent support,” Clark says. The Akamai team also worked alongside Clark’s team to onboard the first couple of websites, giving them the know-how to onboard subsequent sites themselves.

Traffic to City websites was surging even before the pandemic, as residents accustomed to ordering goods and services online applied the same habit to their interactions with government. The pandemic accelerated the trend, as City departments launched new websites in response to shortened office hours, new services like financial resources for renters, and employees working from home. “Over the course of a few weeks at the beginning of the pandemic, web traffic surged by more than 1,000%,” Clark says. “With Akamai, departments could quickly protect their new websites. Having a service partner like Akamai that can scale up quickly has been invaluable.”

The City of LA ISOC gives each department the freedom to select the technologies that best meet their needs. To explain the advantages of Akamai to IT directors — especially the ease of protecting new websites and fine-tuning rules — Lee held meetings with the Akamai team to answer questions. “After the first few departments made the switch, word quickly spread that Akamai offers great protection and that the transition is easy,” Lee says. A growing number of departments are asking for Akamai as their contracts with other WAF vendors expire.

“When a vendor like Akamai can help me as CISO introduce a new service, it’s a win-win,” says Lee. “I appreciate that Akamai is flexible and supportive — giving us what we need to protect the City of LA websites that residents and the workforce depend on for vital services.”

The City of Los Angeles is the second-largest municipal government in the U.S., employing more than 50,000 people in 44 departments. In 2021, the Center for Digital Government named the City of LA IT Agency a winner in its Digital Cities Survey, recognizing its use of technology to tackle social challenges, enhance services, strengthen cybersecurity, and more. www.lacity.org