Instructors

Philip Hagen has over fifteen years of experience in information security, running the gamut from deep technical tasks to management of an entire computer forensic services portfolio.

Phil started his security career while attending the US Air Force Academy, with research covering both the academic and practical sides of security. He served in the Air Force as a communications officer, and was assigned to a base-level year 2000 project management office. The plans he helped create were later used during California's rolling power blackouts. At the Pentagon, he later managed a support team serving 200 analysts.

In 2003, Phil shifted to a government contractor, providing technical services for exotic IT security projects. These included systems that demanded 24x7x365 functionality. He supported the design, deployment, and support of a specialized network for 100 security engineers in ten offices. He later managed a team of 85 computer forensic professionals in the national security sector. He has provided forensic consulting services for law enforcement, government, and commercial clients.

Currently, Phil is the CEO at RedCanary, where he oversees the development and growth of their managed threat detection service, which minimizes the time between a compromise and detection. This helps to support faster and more decisive remediation of network-based intrusions.

Listen to Phil discuss "IT'S ALIVE!!! Investigating with Network-based Evidence" in this SANS webcast that every DFIR professional should listen to.

Type	Course / Location	Date	Register
Training Event	FOR572: Advanced Network Forensics and Analysis SANS Sydney 2014 Sydney, Australia	Nov 10, 2014 - Nov 22, 2014
Training Event	FOR572: Advanced Network Forensics and Analysis SANS Bangalore 2014 Bangalore, India	Sep 15, 2014 - Sep 27, 2014
Training Event	FOR572: Advanced Network Forensics and Analysis SANS Security West 2014 San Diego, CA	May 8, 2014 - May 17, 2014
Simulcast	FOR572: Advanced Network Forensics and Analysis Online	May 10, 2014 - May 15, 2014
Summit	FOR572: Advanced Network Forensics and Analysis Digital Forensics & Incident Response Summit Austin, TX	Jun 3, 2014 - Jun 10, 2014
Training Event	FOR572: Advanced Network Forensics and Analysis SANSFIRE 2014 Baltimore, MD	Jun 21, 2014 - Jun 30, 2014
Training Event	FOR572: Advanced Network Forensics and Analysis SANS Boston 2014 Boston, MA	Jul 28, 2014 - Aug 2, 2014

*Course contents may vary depending upon location, see specific event description for details.