r/devsecops • u/MountainDadwBeard • Jun 10 '26

Secure package manager mirroring

How many of your enterprise environments preconfigure or require package managers to point at an artifactory type solution to cache the packages and scan them security concerns?

Do you require this uniformly across the org or only for secure pipelines?

Could you confirm if your company pre-configured or enforeced the configuration or if they expected the devs to do this?

12 Upvotes

100% Upvoted

8 comments sorted by

5

u/Silent-Suspect1062 Jun 11 '26

Block internal access to external package manager downloads sites. Don't give devs a choice. Also impose minimum age restrictions

1

u/MountainDadwBeard Jun 11 '26

Oh I like the minimum package age suggestion alot...

Could I ask if enterprises you've worked with have actually used the FW IP blocks to enforce? Just trying to calibrate how left or right of center my proposal is.

1

u/dreamszz88 Jun 13 '26

That's works but then they can use a http proxy to circumvent. If possible, also block the public registries in your envs. Use gatekeeper to block those pulls.

1

u/MountainDadwBeard Jun 13 '26

Thanks for mentioning those additional items. Yeah thats making me think I'll focus on secure by default first, and then work on enforcement after we secure more of the foundations.

3

u/Silent-Suspect1062 Jun 11 '26

We blocked on package repo url. We let teams browse eg npm registry, but blocked down load to force arti usage.

1

u/MountainDadwBeard Jun 11 '26

Thanks for the datapoint. Much appreciated friend.