Kevin Ripa

Kevin Ripa

Kevin serves as president of The Grayson Group of Companies, which consists of Computer Evidence Recovery, Pro Data Recovery Inc., and J.S. Kramer & Associates, Inc. He provides investigative services to various levels of law enforcement, Fortune 500 companies, and the legal community. He is past president of the Alberta Association of Private Investigators and a former member of the Canadian Department of National Defence, where he served in both foreign and domestic postings. Kevin is a 25+ year digital investigation veteran with hundreds of speaking and training engagements around the world.

More About Kevin

Upcoming Courses

Profile

An investigator at heart, Kevin Ripa bought his first computer as a tool for writing reports for his private investigation agency. As he worked through typical user issues, the "why" of what was going wrong in his machine kept him up at night. So Kevin turned his investigative skills toward his computer and quickly became fascinated by the world inside of it. Now a 25-year veteran of the digital investigations field, Kevin's enthusiasm has not waned: "IT security and digital forensics still inspire me every day, and I can't wait to wake up in the morning and get to work!"

Kevin has assisted in many complex cyber-forensics and hacking response investigations around the world. He's a sought-after resource for his expertise in information technology investigations and frequently serves as an expert witness. In one memorable case, Kevin had a client charged with a heinous crime and facing significant jail time. "There was no question that the contraband material was on his computer, but our investigation proved conclusively that he could not have placed the material on the computer, nor was the computer even in his custody when the material was downloaded and viewed," explains Kevin. "In fact, the material had been placed on his computer inadvertently by his accusers, without them knowing that they had done it."

Back when he was a student, Kevin had chosen SANS because of the caliber of the instruction. Today he is a SANS instructor for SEC301: Intro to Information Security, SEC401: Security Essentials: Network, Endpoint, and Cloud, FOR500: Windows Forensic Analysis, and FOR578: Cyber Threat Intelligence. He is also teaches and is the co-author of the FOR498: Digital Acquisition and Rapid Triagecourse."I teach because I love to share knowledge, and I teach for SANS because it is the best of the best," Kevin explains." I am really fortunate that SANS appreciates my knowledge and allows me the opportunity to pass it on. I love teaching security and DFIR, because it's like talking about my hobby. And when a student's light bulbs come on, it makes it even more worthwhile."Kevin's teaching philosophy is that the instructor is there for the students, not the other way around. "If my students do not 'get' something by the end of the section, or day, or course, it is me that has failed as an instructor," he says. Kevin sees it as his duty to make the information understandable to each one of his students, and he wants his students to walk away from his classes reinvigorated about the field they have chosen and feeling they can make an actionable difference in the security of their enterprise. He also strives to remind them that humility is vital for career success.

Qualifications Summary