Tim Lee, CISO, City of Los Angeles Learn how the City of Los Angeles, faced with tight budgets and limited security personnel, successfully implemented a data-focused approach to ensuring cybersecurity across departments. The CISO of the City, Timothy Lee, details how the City built an Integrated Security Operations Center, analyzing 14 million+ events per day, using Splunk Cloud and the Splunk App for Enterprise Security.

1. Copyright © 2015 Splunk Inc.
Splunk Cloud as a
SIEM for Cybersecurity
Collaboration
Tim Lee
CISO, City of Los Angeles

2. Mayor’s Executive Directive on
Cybersecurity
• Mayor Eric Garcetti issued Executive Directive to create a
City of Los Angeles Cyber Intrusion Command Center (CICC)
to lead cybersecurity preparation and response across city
departments. The Center will be led by the office of the
Mayor and will include assistance from FBI and Secret
Service.
“I’m creating this Cyber Intrusion Command Center so that we
have a single, focused team responsible for implementing
enhanced security standards across city departments and serving
as a rapid reaction force to cyber-attacks,”
Mayor Eric Garcetti
2

3. Our Challenge
IT Security Team is understaffed
Dispersed log capturing capabilities
Minimal use of collaboration tools
Lack of Incident Management platform
No integrated threat intelligence program
Limited situational awareness and operational
metrics for City as a whole
Imbalance in response capability
Growing cyber threats including DDoS & Malware

4. Our Solution
Integrated Security Operations Center
(ISOC)
Leveraging Splunk Cloud and Splunk
Enterprise Security

5. SIEM / ISOC Integration

6. How Did We Sell It Internally?
• Prepare to answer why you need SIEM and why cloud-based
 Security Audit Report (Recommendation and Action Plan)
 Compliance Gap Assessment Report
 Security metrics (numbers of intrusion attempts, incidents, outages caused by incidents, top
attackers, threat activity and trends etc.)
 Present it from the business risk perspective
• Engage others outside of IT to also help sell it
• Provide potential risks of not implementing SIEM
• Share real-world examples of cyber incidents and costs that your audience can
relate to
• Provide source of funding for implementation and operations
• Align results to organizational goals

7. Example: Executive Dashboards

8. Use Case Example: Top Attackers

9. Use Case Example: Top Destination
By Specific Attacker

10. Use Case Example: Malware Monitoring

11. Q&A

12. THANK YOU