Many departments, one web security solution
When the City of Los Angeles formed an integrated security operations center for 40+ departments, the Chief Information Security Officer looked for a web application firewall that made it fast and simple to protect new sites, update rules, and scale. The City found its answer in Akamai Professional Services, which helped to ensure a smooth transition from the old firewall with zero downtime. And when web traffic jumped by 1,000% during the COVID-19 pandemic, Akamai scaled without a hiccup.
More city services go digital
The City of Los Angeles is the second-largest city in the U.S., serving 3.9 million residents through more than 40 departments — from the Department of Aging to the Los Angeles Zoo. “Public websites are the face of the City of Los Angeles,” says Timothy Lee, the City’s Chief Information Security Officer (CISO). “They’re our brand. Residents and employees expect 100% availability and count on us to protect their personal information.”
In the past, most departments ran their own security operations center. But not having a centralized view of cyber incidents delayed awareness of new kinds of attacks. In 2014, the mayor formed a centralized group to coordinate cyber activities, appointing Lee, then CISO for the Port of Los Angeles, as the City’s first CISO. “I was hired to design and implement a single, coordinated cyber strategy,” Lee says. “An important part of that strategy is a unified view of cyber incidents across all departments and shared platforms as much as possible.”
40+ departments, single pane of glass
Lee’s team set to the task of building an integrated security operations center (ISOC) serving 40+ departments. “The ISOC detects about 1 billion security events a day,” says Daniel Clark, IT Agency ISOC Manager for the City. A growing number of those events are “zero-day” exploits, targeting newly discovered vulnerabilities before vendors can update their code and system administrators can install the updates. “Securing all of the City’s public-facing websites with a WAF [web application firewall] is a key element of our cyber strategy,” Clark says.
Lee and Clark concluded that the existing WAF came up short for serving many departments. Adding protections to new websites and fine-tuning rules was too time-consuming and cumbersome. Evaluating the top WAFs in the Gartner Magic Quadrant, Clark and Lee selected Akamai App & API Protector with Bot Manager.
“Akamai protects our websites against zero-day threats,” Clark says. “It’s simple to set up. And it works with every department’s websites without a lot of customization.” Lee adds, “When I choose a partner, I look at more than technical features. The biggest difference between leading vendors is often their flexibility. Akamai agreed to work with us on a phased deployment to meet our timeline and budget constraints.”
Smooth transition, with zero downtime
During the cutover to Akamai, Clark and Lee engaged Akamai Professional Services to ensure a smooth transition — turning on Akamai as the previous WAF was decommissioned. “We had zero downtime when we switched from our old WAF to Akamai and received excellent support,” Clark says. The Akamai team also worked alongside Clark’s team to onboard the first couple of websites, giving them the know-how to onboard subsequent sites themselves.
The scale to adapt to the unexpected
Traffic to City websites was surging even before the pandemic, as residents accustomed to ordering goods and services online applied the same habit to their interactions with government. The pandemic accelerated the trend, as City departments launched new websites in response to shortened office hours, new services like financial resources for renters, and employees working from home. “Over the course of a few weeks at the beginning of the pandemic, web traffic surged by more than 1,000%,” Clark says. “With Akamai, departments could quickly protect their new websites. Having a service partner like Akamai that can scale up quickly has been invaluable.”
Over the course of a few weeks at the beginning of the pandemic, web traffic surged by 1,000%. With Akamai, departments could quickly protect their new websites. Having a service partner like Akamai that can scale up quickly has been invaluable.
Daniel Clark, IT Agency Integrated Security Operations Center Manager, City of Los Angeles
Swift uptake by City departments
The City of LA ISOC gives each department the freedom to select the technologies that best meet their needs. To explain the advantages of Akamai to IT directors — especially the ease of protecting new websites and fine-tuning rules — Lee held meetings with the Akamai team to answer questions. “After the first few departments made the switch, word quickly spread that Akamai offers great protection and that the transition is easy,” Lee says. A growing number of departments are asking for Akamai as their contracts with other WAF vendors expire.
When a vendor like Akamai can help me as CISO introduce a new service, it’s a win-win. I appreciate that Akamai is flexible and supportive — giving us what we need to protect the City of LA websites that residents and the workforce depend on.
Timothy Lee, Chief Information Security Officer, City of Los Angeles
“When a vendor like Akamai can help me as CISO introduce a new service, it’s a win-win,” says Lee. “I appreciate that Akamai is flexible and supportive — giving us what we need to protect the City of LA websites that residents and the workforce depend on for vital services.”
About the City of Los Angeles
The City of Los Angeles is the second-largest municipal government in the U.S., employing more than 50,000 people in 44 departments. In 2021, the Center for Digital Government named the City of LA IT Agency a winner in its Digital Cities Survey, recognizing its use of technology to tackle social challenges, enhance services, strengthen cybersecurity, and more. www.lacity.org
About Akamai
Akamai powers and protects life online. Leading companies worldwide choose Akamai to build, deliver, and secure their digital experiences — helping billions of people live, work, and play every day. With the world’s most distributed compute platform — from cloud to edge — we make it easy for customers to develop and run applications, while we keep experiences closer to users and threats farther away. Learn more about Akamai’s security, compute, and delivery solutions at akamai.com and akamai.com/blog, or follow Akamai Technologies on Twitter and LinkedIn.
