Sign In

Georgin Lau

Simplifying architecture, reducing complexity, building robust detection & response capabilities.

Georgin Lau is a seasoned professional in the field of security and analytics, currently holding the position of Head of Security Engineering at Crypto.com. Here are some key points about his background and expertise:

  • Professional Experience: Georgin Lau has a strong background in detection engineering and threat analytics. He is experienced in building and optimizing threat analytics systems.1
  • Industry Expertise: He has a robust background in the financial services industry, particularly in the APAC region, where he has held roles such as APAC Head Of Analytics.
  • Skills: Georgin Lau is skilled in stakeholder analysis, threat detection, and security alerting. He also has experience with concepts related to Site Reliability Engineering (SRE) that are applicable to security alerting.2
  • Education and Affiliations: He is associated with Singapore Management University.1

Overall, Georgin Lau is a highly experienced leader in the security and analytics domain, with a strong track record in the financial services sector.

Highlights

May 16 · linkedin

This works for me too.

May 10 · linkedin

This is something I think about a lot and for a detection engineer, I would be stating the obvious. Obvious things, however, can be unnoticed by many people. Expressed through my doodles, my interpretation is not empirical but I dare say worthy as an expert’s intuition. Most organisations try to move up the curve to develop and implement more advanced detections. If you notice, first of all, all detection types (the small coloured bubbles) lie on the area of FPs (false positives). Even the most definite malicious IoC, baddomain[.]xyz, that is bad today, might turn into a FP in 30 days. This also brings the point that detections have an expiry. While it may not be as obvious as an IoC age out expiry concept, the effectiveness of detections built to detect suspicious activity XYZ can decay over time because the activity can no longer happen because of a change in control on the target environment, or because of some other change at the source generating that event.

Which type of detections should you then focus on? I think it really depends on the current state the organisation is at and amount of resources you can commit to the ‘build-and-fine-tune’ cycles. Hope this was a fun read for some of you out there.

Related Questions

What are Georgin Lau's key achievements at Crypto.com?
How did Georgin Lau transition from detection engineering to security engineering?
What projects has Georgin Lau led at Crypto.com?
What is Georgin Lau's educational background?
How does Georgin Lau's work at Crypto.com impact the company's security strategies?
Georgin Lau
Georgin Lau, photo 1
Georgin Lau, photo 2
Add to my network

Location

Singapore, Singapore