Profile
Prior to joining FTI Consulting, Adam was the Managing Director of Lodestone Security, a wholly owned subsidiary of Beazley. He has also held several leadership roles in large consulting Incident Response Practices including IBM's X-Force Incident Response team, where he was Global Delivery Lead and EMEA Practice Lead, and Verizon's VTRAC Team. During this time he has conducted and overseen the execution of hundreds of incident response engagements, and he brings that real-world experience and up to date insight into the classroom.
He considers himself an investigator first and forensicator second. Excited by the challenge of cracking a case or solving a mystery, he found his technical skills could be put to use in Digital Forensics. After a number of years working traditional forensic investigations including fraud, intellectual property theft and other criminal matters he chose to focus on Incident Response where in his own words "the adversaries are technically astute, those you are investigating know that they will be investigated and go to great lengths to cover their tracks. This raises the bar and makes the challenge all the greater."
First as an investigator and now instructor, Adam's enthusiasm for learning sees him constantly reading, researching, and studying to expand his knowledge. This is a trait he considers essential to anyone who wants to be successful in this line of work. "It's all too easy to rest on your laurels and try sticking to the same techniques which have served you well in the past, but in the fast-paced world of DFIR that can be fatal. The attackers are always changing up their techniques, so you have to as well". The only thing he enjoys more than learning about a new technique or artifact is sharing that knowledge with others.
Adam Has a BSc in Information Management and Business Studies from Loughborough University. His first GIAC certification was as a GIAC Certified Forensic Examiner (GCFE) in 2004 and he has since attained GASF, GCFA, GCFE, GCIA, GCIH, GEIR, GMOB, GNFA, GPYC, GREM, GSEC and GWAPT, as well as a number of other industry certifications.
When he isn't knee deep in an investigation, Adam spends most of his free time with his family and is also a keen photographer, runner and cyclist. "Even when wrapped up in an incident, I try to carve out time to get out for a run or walk. Not only does this help to protect my sanity but it's surprising how often getting out and clearing the mind will enable you to make that key breakthrough when you get back to your desk."
Qualifications Summary
- 15+ years experience in Digital Forensics and Incident Response
- Instructor SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
- GIAC Advisory Board Member since June 2014
Certifications
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Certified Forensic Examiner (GCFE)
- GIAC Enterprise Incident Response (GEIR)
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Certified Incident Handler (GCIH)
- GIAC Reverse Engineering Malware (GREM)
- GIAC Network Forensic Analyst (GNFA)
- GIAC Python Coder (GPYC)
- GIAC Advanced Smartphone Forensics (GASF)
- GIAC Mobile Device Security Analyst (GMOB)
- GIAC Web Application Penetration Tester (GWAPT)
- GIAC Security Essentials Certification (GSEC)
- EnCase Certified Examiner (EnCE)
- Nuix eDiscovery Certified Specialist
- AccessData Certified Examiner (ACE)
- Certified Mobilyze Operator (CMO)
Get to Know Adam Harrison