Khaled Farah
Senior Security Engineer
Amazon Web Services
Senior Security Engineer with 10+ years of experience securing cloud infrastructure and production systems across AWS and Azure environments. Hands-on experience in threat modelling, detection engineering, and automated response across distributed systems. Experienced in securing high-risk financial systems handling regulated workloads and sensitive transactions, with working knowledge of blockchain systems and key management. Currently a Senior Security Engineer at AWS, with vulnerability research recognised by Microsoft, Google, and Uber, and experience speaking at Black Hat.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
The Illusion of Secure CI/CD: Exploiting Modern GitHub Actions Pipelines
Modern CI/CD pipelines built on GitHub Actions are widely assumed to be secure by default due to features such as required approvals, restricted secrets access, and hardened workflow permissions. In practice, these assumptions often break under real-world conditions.This session demonstrates how attackers can exploit misconfigurations and design gaps in production pipelines to achieve secret exfiltration, unauthorized code execution, and supply chain compromise. Through live demonstrations and real-world case studies, we walk through multiple attack paths that bypass commonly trusted safeguards, including approval gates, fork protections, and environment restrictions.The talk focuses on practical exploitation techniques rather than theory, showing how small oversights can lead to full compromise. It concludes with defensive strategies that address structural weaknesses in pipeline design instead of relying on surface-level controls.
- 15:10
- Wed
- 02 Dec
Stage:
Briefing Stage 1
Sessions Type:
Keynote