Mohammed Hussien
Endpoint Detection and Response Lead
Saudi Energy
Mohamed Hussein is a cybersecurity professional specializing in data security and enterprise security architecture, with a focus on the Gulf/MENA market. Based in Egypt with ties to Tunisia, he brings hands-on expertise across leading DLP platforms (Symantec, Microsoft Purview), IBM Guardium, and Cortex XDR. Fluent and effective working bilingually in Arabic and English, Mohamed combines deep technical security knowledge with regional market insight.
Speaker sessions
Briefings and Arsenals | Confirmed Speakers | No Session Assigned
Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.
- 07:30
- Tue
- 01 Dec
Stage:
Briefing Stage 2
Sessions Type:
Keynote
ChainGate: An Install-Time Integrity Gate for npm Packages
We have been studying how npm package metadata changes from one release to the next, how registry cleanup affects the historical record, and whether package-specific deviations can provide useful warning signals. That research now informs ChainGate, a customer-operated install-time integrity gate for npm. ChainGate runs as a local registry proxy. It keeps a witness history for observed packages and compares a requested release with the package’s prior state. Deterministic gates examine publisher identity, provenance continuity, dependency structure, release age, scope boundaries, and content integrity.
The result is an explainable ALLOW, WARN, or BLOCK decision with the evidence that produced it. Deep tarball analysis remains important, but applying every form of content analysis at the consumer endpoint can add cost and latency. ChainGate provides a complementary first stage that uses metadata and history to identify releases requiring closer inspection. It does not claim that metadata alone proves malicious intent.
The current prototype includes the CLI, proxy, witness store, signed seed consumption, and gate runner. For the December demonstration, we plan to show how the same deterministic rules and evidence can be exported as Detection-as-Code for customer-owned tools such as SIEM, EDR, CI pipelines, and agent workflows. The goal is to give defenders a transparent local control point instead of another opaque risk score.
- 16:20
- Tue
- 01 Dec
Stage:
Arsenal 2
Sessions Type:
Keynote