Albert Yu

Primary focus: GCP usage secure by default for Googlers. Previous focus: Google Trust Services (GTS), the root certificate authority.

My major role was to recruit, build and lead the team from the group up to implement a unified permission service on AWS that empowers Atlassian customer facing products.

I focused on researching, designing and building advanced security systems. My major role was to provide ideas, technical guidance and build prototypes for various advanced security projects, including key management system, cryptographic protocols, authentication and authorization systems, static code analysis and dynamic scans. My last assignment there was to provide a technical design and an implementation for deploying network access control across *all* (rougly a quarter million) the machines in production in real time. Projects that I have contributed: 1. Gryffin - a large scale web vulnerability scanner framework that focused on efficiency (crawling deduplication) and accuracy (DOM-based) 2. Tainted PhantomJS - XSS detection via tainted analysis using a modified version of Phantom JS. 3. HTML context parser - using HTML5 tokenization for context parsing (without building DOM tree), thus arriving in an extremely fast implementation. Usage of that includes building contextual aware HTML templating (i.e. XSS free) modules. 4. Pseudo static analysis - build solutions to detect common or recent vulnerabilities in source code written in programming languages where conventional static analysis would not be viable. 5. Network access control - real time network level access control protection at large scale (as described in previous paragraph).

I joined as a software engineer with specialty in information security, and then quickly took the senior technical lead for driving the security program across APAC offices towards high maturity. My responsibilities includes the following: Lead the security professionals in individual offices to establish the security process and provide hands-on guidance. Assess the quality of customer facing products via security review, code review, and bug scrubbing. Promote security awareness by training and providing consistent guidance to engineers. Improve the usability of security policy and standard documents to cope with the up-to-date technologies. Analyse compliance (e.g. PCI DSS) and risk management requirements and translate into product requirements. Conduct security researches. Enhance and maintain our security tooling. Handle exception tasks such as M&A, incident response, etc

Primarily focused on converting academic security researches into practices through industrial collaboration, in the Center for Information Security and Cryptography under the Computer Science Department.

Part-time. Research interest: Cryptographic anonymous authentication protocol with reputation and revocation support.

Research interest: Aging problem of cryptography