The City of Las Vegas needed to detect, prioritize, and remediate cybersecurity vulnerabilities

Best known for its entertainment, sporting, and convention facilities, the City of Las Vegas serves 650,000 full-time residents and millions of tourists year-round, with everything from parks and recreation and public safety to general municipal operations. The city employs 3,500 dedicated professionals whose job it is to ensure that everyone who visits or lives in Las Vegas receives the best possible experience.

Michael Sherwood, Chief Innovation Officer for more than three years, is an experienced strategist, technologist, and innovation leader. Formerly the Director of IT for the City of Las Vegas, Sherwood has broadened his role and oversight. He is not only responsible for keeping the city’s assets secure, but for envisioning and executing the city’s use of technology today and into the future.

The enterprise security team wanted to gain more insights into OT devices

What initially prompted the city to consider Armis from ServiceNow was a desire for more information about and control over the many connected operational technology (OT) devices in its Internet of Things (IoT) network, such as safety sensors for traffic intersections. Since the city’s devices are constantly being changed out, Sherwood had increasing concerns about potential vulnerabilities in new assets being brought into the environment and whether the existing assets were patched properly.

“I always feel that I could use more information, more detail, and more insights—the best information I can get. The better the data I have, the better the decisions I make for the city,” he explained.

An Armis from ServiceNow PoV provides immediate results by identifying security flaws in white-labeled devices

Almost immediately after launching the Armis proof of value (POV), the city saw results. Within five or 10 minutes of the PoV, Armis found several wireless assets that had critical vulnerabilities.

Sherwood approached the device vendor to address those security flaws, and initially the vendor was unaware of them. But, with the insights from Armis, the vendor was able to fix the security flaws and bring the products up to required standards and so that the City of Las Vegas could allow them to remain on the network.

“Armis not only helps us maintain our assets and see how they’re performing, it also helps us view each asset in detail, including its vulnerabilities and potential exploits that even the manufacturer may not know about,” Sherwood explained. He pointed out that since a lot of products are white labeled, often the seller of a product is actually a reseller who didn’t develop the software or the product. Armis helps identify the actual manufacturer.

CAASM contextualizes assets, prioritizes threats, and manages sensor sprawl to deliver an enhanced security posture

Sherwood points out that, with so many threats to respond to in today’s world of interconnected networks and BYOD devices, it can be challenging to know which threats to prioritize. “Really knowing your attack surface is vital if you want to protect your digital assets and your digital information,” he said.

That’s where the Armis platform’s Cyber Asset Attack Surface Management (CAASM) capabilities come in to contextualize assets in the environment with data and insights and present them a unified view. Sherwood explains that Armis provides an easy-to-access dashboard of everything in the environment and allows staff to quickly get on board and get the same insights.

Armis helps Sherwood know what the assets are doing, who is using them, and even if they are being used at all. “I call it ‘sensor sprawl’,” he said. “Often, with IoT and the advancement of technology, you have assets that are out there that you had been using, but over time they fall off the radar. So really understanding your inventory of assets is extremely critical. It’s also a security challenge.”

With CAASM, Sherwood can see which assets have higher exposure and should be prioritized first. “Having that insight is so critical in understanding and mitigating risk,” he explained. “Armis helps us to not only understand our environment and our assets, but also to prioritize how we go about using the vital resources we have. If assets aren’t being utilized, we can remove those assets from our environment.”

Armis data fuels seamless integrations across the technology stack

Sherwood uses Armis as one of his principal sources of information. “We’re able to use it in conjunction with our configuration management database (CMDB) and leverage its data in other applications as well,” he shared.

In addition to the ServiceNow AI Platform for internal customer service handling and delivery, Armis is integrated with other key cybersecurity tools the city uses, CrowdStrike and SentinelOne—for endpoint protection.

“Armis really helps us have a seamless management integration with all our cybersecurity tools,” says Sherwood. “There are so many nuances we’ve learned about our network that we’ve been able to defend against based on the information Armis provides. It’s an essential part of our technology stack and helps us safeguard the city’s digital assets,” he asserted.

Efficiency gains extend beyond vulnerability prioritization  

In addition to improving vulnerability prioritization, Armis has lent itself to improving operational efficiencies for the city in a relatively short period of time. For example, before Armis, the staff would have to manually inspect devices individually, by manufacturer, to understand where they were in a patching cycle. The process was time-consuming and inefficient.

Sherwood says that Armis has allowed the staff to prioritize and be methodical in keeping the network secure. “It really improves our key performance indicators (KPIs) and our business processes,” he said. Since the Armis deployment, there has been a reduction of noncompliant devices by approximately 80%.

Sherwood credits the Armis platform’s easy-to-use interface, “It allows us to scan the environment quickly, identify and prioritize issues, and then go in and make those necessary repairs to keep the city’s assets as safe as possible.”

A partnership for the long haul delivers increased cybersecurity excellence to Las Vegas

With its vast IT and OT environment, the City of Las Vegas relies on Armis as a core component of its cybersecurity strategy, gaining a better understanding of its many IoT assets and their potential vulnerabilities.

As a long-time Armis user, Sherwood appreciates the relationship he and his team have built with the Armis team. “The company has really gotten to know our network and understand our operations. It’s like having an extension of our IT department—fully available to us day to day, as we not only defend and protect our assets, but also advance our efficiency and technology within the organization,” he remarked.

Sherwood believes that it’s not just about investing in a tool, it’s about investing in a company and its people. “We’ve watched the Armis platform grow and mature. It is continually evolving as the threat landscape changes, and it is advancing along with the City of Las Vegas to keep our assets defended now and well into the future,” he concluded.