Arctic Wolf Helps Bay Area City Stay Protected and Reduce Cyber Risk

技术

网络安全和隐私 - 网络安全

适用行业

城市与自治市
公用事业

适用功能

设施管理
商业运营

用例

入侵检测系统
网络安全
远程资产管理

服务

系统集成
网络安全服务
培训

挑战

Cyberattacks on local governments are increasing at an alarming rate. In recent years, there have been major attacks on Atlanta and Baltimore, other large metro government agencies, and smaller locales. Atlanta’s recovery stretched out for more than a year to the tune of approximately $7.2 million. These cyberattacks can potentially disrupt critical infrastructure like utilities upon which residents rely. Because utilities are so critical, they are now high-value targets for malware, ransomware, and denial-of-service attacks. And hackers often have a false perception that cities can simply print money to quickly get their vital systems up and running again. As attacks on cities made increasing headlines, one city government in the San Francisco Bay Area knew they needed to fortify its network and systems. As a first step, it joined government-sponsored organizations related to cybersecurity such as the Multi-State Information Sharing and Analysis Center® (MS-ISAC) that releases frequent bulletins on potential zero-day attacks and critical patches. The city shared this and other information with their IT staff, but knew there was more it needed to do.

关于客户

This city government in the San Francisco Bay Area serves a population of more than 150,000 residents. After World War II, housing developments began replacing farms and ranches in the area—leading to a growth boom and attracting a highly diverse population. Today, the city has a thriving regional center of commerce, manufacturing, and trade, making it a very desirable business location for advanced industries. The city continually balances the needs of its diverse population and growing business community—providing services and essential utilities that meet the needs of both constituencies.

解决方案

The city’s IT staff conducted a security audit of their entire operation and determined they should create a security operations center to bolster their protection. In the event of a cyber emergency, they could engage a team of individuals who monitored the network to provide resources, guidance, and potential resolutions. The team considered adding a cybersecurity expert to its staff, but the salary requirement was cost-prohibitive when recruiting for this particular skillset in the Bay Area. Understanding the city needed a cost-effective solution that provided 24x7 coverage with deep cybersecurity expertise, the IT Manager began the search for a service provider, and then discovered Arctic Wolf. Not only did Arctic Wolf provide the necessary expertise, it also provided a whole team of cybersecurity experts and forward-looking guidance. The IT Manager conducted research on other offerings in the cybersecurity marketplace and found the Arctic Wolf® Platform for threat detection and response and Concierge Security® Team was the right fit for the city. An individual on the Arctic Wolf team would be dedicated for onboarding—working with the city’s IT staff, going through the entire network, and reviewing all of the network’s elements. The IT Manager believed this would lead to quicker resolutions in the event of an attack. Arctic Wolf already had all the connectors prebuilt and log ingestion integrations ready to be launched, which allowed the city to stand up a solution within a couple of months.

运营影响

Through its partnership with Arctic Wolf, the IT Manager believes security gaps have been closed in the city’s IT network and systems. Still, he also recognizes the need to continue to be vigilant. The complexity, sophistication, and organization around cyberattacks are increasing with novel approaches always on the way. But with Arctic Wolf’s threat detection and response solution, the IT Manager says he can sleep better at night for two reasons.
First, Arctic Wolf’s entire customer base is sharing information and continually learning from each other’s experiences, allowing the insight gained to be spread across all their customer sites. As the IT Manager says, “Not only do we gain an entire security team, but we also tap into the collective knowledge of all of the other customers that share their security logs with Arctic Wolf.”
Arctic Wolf and the city’s IT team meet every two to four weeks to review the current threat landscape and align on what constitutes an alert. This process and the use of Arctic Wolf’s machine-learning security information and event management (SIEM) technology has led to the city’s IT staff receiving fewer alerts—and having to act on only important alerts.

数量效益