CEO & CISO | Scott Larson provides expert services with multi-disciplined teams to minimize client risk and protect their assets. He is a former FBI Headquarters Chief of the Computer Investigations and Infrastructure Threat Assessment Program at the National Infrastructure Protection Center (“NIPC”) responsible for both criminal and national security computer intrusions spanning all critical infrastructure sectors. Mr. Larson has significant experience in conducting investigations and assessments (e.g. PCI DSS, ISO 27001:2013, GDPR, FFIEC/FDIC, NIST SP800-171, FIPS 140-2, FDA Warning Letters, HIPAA/HITECH ‐ including HIPAA Business Associates) for corporations in various industries (e.g. healthcare, pharma, financial institutions, defense, energy, information technology, retail, hospitality and supply chain sectors), a United States (“US”) presidential campaign and for government entities including serving as a program management expert for the FBI Cyber Division and being the investigative technical lead while at the FBI for the InfoSec Working Group information security assessment post‐investigation of the former Special Agent Robert Hanssen espionage case. The recommendations of the InfoSec Working Group led the FBI to create their Enterprise Security Operations Center (“ESOC”) and undertake a re‐tooling of information security policy, standards, guidelines and procedures. Mr. Larson has extensive experience in participating in military, government, private critical infrastructure protection and traditional corporate full‐field exercises and real‐world network/security operation center crisis response. He was one of the first FBI Special Agents to attend and later lecture at the National Security Agency’s (“NSA”) Network Forensics Course that included attack and defend hacking scenarios and led the FBI response to successfully catch the “Red Team” in the “Eligible Receiver” simulated exercise that attacked the critical infrastructure and the military systems of the United States.
As a consultant, Mr. Larson has vast experience in responding to data breaches, including in the context of corporate and state‐sponsored espionage; the Advanced Persistent Threat (“APT”); intellectual property theft; employment matters; security reviews; FCPA matters; PCI, SOX, GLBA, HIPAA-HITECH Act, and EU Privacy Directive assessments; malicious code analysis; vetting software for spyware and fraud; and cyber counterintelligence measures with custom tool development. His experience includes cases involving instances of theft or data loss from highly sensitive corporate and government environments; conducting reviews of banking applications and end-user systems for data breach/unauthorized payment transfers and fake tax returns; conducting incident response and security assessment for a major government and non-profit organizations involving HR enterprise database software (e.g. Oracle, SAP, Lawson/Infor, Siebel, MS SQL Server) payroll payment re-direction & other human/customer resource systems; analyzing software for privacy and regulatory violations; assessing cloud computing environments for privacy, security and compliance; behavioral advertising privacy; performing expert analysis of spyware; digital forensics and eDiscovery litigation support to law firms; and providing expert consulting services to the FBI Cyber Division as an expert into a hack into the United States Supreme Court.
He has testified in settlement proceedings before the Federal Trade Commission (“FTC”) and numerous State Attorneys’ General in consumer privacy issues, most notably the Sony BMG Digital Rights Management (“DRM”) “Rootkit” matter. That controversy required reverse engineering and system testing to determine the scope and functionality of the DRM software as it related to consumer privacy consent and the collection of personally identifiable information (“PII”). Mr. Larson was also the neutral expert appointed by US Federal Magistrate Judge Facciola (District of Columbia) to process the digital media related to the FBI’s search of Representative William Jefferson’s congressional offices and subsequent challenge by Congress under the “Speech or Debate” clause of the US Constitution. Mr. Larson has also conducted both computer forensics on medical devices and performed a HIPAA/PCI/ISO27001:2013 security assessment in the United States and in the European Union for a major medical device manufacturer. He continues to support global clients, remotely or onsite, from the United States in Asia, Europe (including Russia and the former Eastern Bloc), Central and South America, Africa and the Pacific Rim including Australia.
Mr. Larson enjoys collaboration in cyber security, computer investigation, data analysis and the respective cross-education of these disciplines for C-Level Executives, Board of Directors, Directors, Senior Managers and knowledge transfer for in-house computer forensic and investigative teams. For example, Mr. Larson participated in the White House’s National Security Council’s (“NSC”) Cyber Security Advisory Group on Botnet Mitigation in 2011 and he currently serves on the Advisory Board for Georgetown Law Center’s Cybersecurity Law Institute and the University of Minnesota’s Information Technology Infrastructure Advisory Board. He continues work with many CEO’s, CIO’s, Chief Security Officers (“CSO”) and Chief Information Security Officers (“CISO”) on cutting edge security assessments, product testing and providing a hands-on, unfiltered, enlightened third-party view of complex issues. He holds are has held a litany of certifications including (e.g. CISSP, CISM, CIPP, AME, CCSK, PCIP, PCI QSA, FBI CART Field Examiner).