Security

Clark County, Nev., Boosts Patch Management With Tanium

CIO Bob Leek landed on the endpoint management solution in part because it works well with ServiceNow and Microsoft.

Jessica Balen is a freelance writer for the CDW family of magazines.

Bob Leek doesn’t reboot his computer frequently. As CIO of Clark County, Nev., he’s constantly working on IT projects. His computer may fall out of compliance if he has not updated or patched an application.

He'll then get an alert warning that his computer will reboot and update, and he should save his work quickly.

“I welcome that message because it means that my team is doing what they’re supposed to do, which is to keep us updated with respect to patches and to remediate related security and risk vulnerabilities,” Leek says.

Clark County’s IT team stages and executes its patch management program with Tanium, an endpoint management platform. For example, the county’s network includes roughly 14,000 devices that require regular patching. As a Microsoft customer, Clark County has many Microsoft applications to patch across those devices, Leek says. Tanium helps to maintain patches and ensure everything is in compliance.

“We’ve probably cut our effort by about half,” Leek says.

SUBSCRIBE: Sign up for the StateTech newsletter for weekly updates.

County Aims to Maintain Robust Citizen Services

About 1.1 million of the 2.3 million people in Clark County live in unincorporated Clark County, which is also home to Las Vegas. The county, the 11th largest in the U.S., provides those residents with emergency services such as fire and police. To keep things running smoothly, Leek seeks opportunities to automate operations, particularly because a small number of full-time employees support the county’s IT infrastructure.

“We wanted to make sure that we brought automation into the fold and that we streamlined those operations and really reduced our risks across that full technology stack,” he says.

The IT team considers requirements across the gamut of citizen services. Given that the county contains Las Vegas — the “wedding capital of the world,” according to the state’s tourism website — it must ensure its Marriage License Bureau is running smoothly from 8 a.m. to midnight, seven days a week.

$80.4M

Clark County’s 2025 budget for IT capital projects

Source: clarkcountynv.gov, “Capital Final FY25,” Jan. 8, 2024

“The last thing you want is to upset people that are really happy to be here with the unavailability of the marriage system. They need a marriage certificate, and they need to record all of that. And that’s all digital,” Leek says.

Using a hybrid cloud approach, Clark County runs a data center within an environment that includes most of the major Las Vegas entertainment resorts. As Leek contemplated how he could improve the county’s security posture, he saw inefficiencies in patch management.

He contracted Tanium to help. “We wanted to reduce the amount of time it takes to patch,” he says. “And we mapped out how that worked.”

Patching Benefits from Strong Asset Management

Clark County then analyzed its processes and conducted an assessment for application rationalization to reduce the overall number of solutions it deploys.

“We wanted to identify and remediate things like software vulnerabilities and performance issues,” Leek says. “I get probably a dozen to 20 alerts from either MS-ISAC or CISA or other sources. I got one just today that said Google Chrome could be compromised. Well, we have two choices: We patch Google Chrome or we take Google Chrome out of the environment. Obviously, the second is not an option. We must be effective in responding to those vulnerabilities as we identify them.”

EXPLORE: AI is transforming the citizen experience.

Clark County also depends on ServiceNow for IT services management and automation. It was important to Leek that the ServiceNow configuration management database worked well with a patch management solution. Tanium checked those boxes and also improved asset management by giving the county visibility into its IT vulnerabilities.

Chris Cruz, Tanium’s CIO for public sector, says patch management is a top security concern for government IT leaders.

“Many of our CIOs and CISOs today don’t know how many endpoints are plugged into their networks. It usually turns out to be 15% to 20% more endpoints than originally thought. They are able to identify those components once they have visibility management control and discovery with real-time data.”

Bad actors today are happy to hit small and large government agencies alike, Cruz says.

I need a partner, not a vendor. I get hot dogs from vendors.”

Bob Leek CIO, Clark County, Nev.

County Centralizes Procurement Authority

The Clark County IT department manages tech spending for most of the county. It participates in a budgeting process that takes about five months, Leek says. The IT team works with other agencies to maximize IT investments across government, introducing enterprise solutions such as Tanium for patch management to benefit everyone.

Leek funded the Tanium purchase with infrastructure modernization funds. Working with the county procurement office, he managed a competitive procurement that identified potential solutions and placed Tanium on top.

DIVE DEEPER: Digitization and AI are reshaping state procurement.

“Procurement supports our needs to ensure we appropriately and correctly obtain solutions within state statutes and guidelines. We have great relationships with resellers and then through procurement vehicles such as the National Association of State Procurement Officers as well as CDW and others,” Leek says.

Leek exercises his procurement authority to find the partners and solutions that his county needs.

“I need a partner. I don’t need a vendor. We work with our partners to find the right solutions to our needs. And so that’s the approach that we’ve taken,” he says.

halbergman/Getty Images