Manage firewall policies

Configure firewall policies to define which packages are allowed or blocked in your development pipeline. Use default policies for immediate protection, or create custom policies using the Open Policy Agent (OPA) framework to enforce your organization's specific security and compliance requirements.

Configure policies

Package Firewall uses a policy framework to evaluate dependencies and provide tailored results. A default set of policies applies automatically to all newly created firewalls. You can turn on additional pre-built policies to further protect your dependencies, or create custom policies and add them to the policy framework.

Before you begin:

• You must have a Veracode account in the Commercial region with the Policy Administrator or Security Lead role. Package Firewall currently doesn't support accounts in the United States Federal region.

To complete this task:

1. Sign in to the Veracode Platform.
2. Select Policies > Firewall.
3. Select the firewall for which you want to modify the policy.
4. Navigate to the Policy tab.
5. Use the toggle next to each pre-built policy to turn the policy on or off.
6. You can select the checkbox next to a policy to turn on Warn-only policy. When this option is selected, Package Firewall issues a warning but does not block the package.

Pre-built policies

Package Firewall includes the following pre-built policies that you can turn on to protect your dependencies:

• All Critical (except Software Vulnerability): blocks critical issues, except software vulnerabilities.
• Data Exfiltration: blocks common data exfiltration techniques.
• Per Domain: blocks medium, high, and critical author, engineering, and vulnerability issues, any medium, high, and critical malware issues, and any high and critical license issues.
• Secrets in Non-Test Files: blocks packages containing secrets or tokens in non-test files.
• AGPL Licenses: blocks packages that use AGPL licenses.
• Confirmed Malicious: blocks packages where the package or author is tied to known malicious behavior.
• Install Code Execution: blocks code execution on package install.
• Suspicious URL References: blocks packages referencing sites uncommon to legitimate software.
• Block All Issues: blocks all identified issues.
• Copyleft License: blocks packages that have a copyleft license.
• Software Vulnerability – Critical/High: blocks critical and high software vulnerabilities.
• Suspicious IP References: blocks packages containing suspicious IP addresses.
• Obfuscated Code: blocks obfuscated code.
• Dependency Confusion: blocks dependency confusion.
• All High, Critical Issues: blocks all issues that exceed the medium threshold.
• License Mismatch: blocks license mismatches between metadata and files.
• Install Code Execution (Suspicious): blocks suspicious code execution on package install.
• Runs Remote Code: blocks packages that run remote code.
• Software Vulnerability – Critical: blocks critical software vulnerabilities.
• Minimal Code: blocks packages containing minimal code.
• Typosquat: blocks packages that have potential typosquat with malicious characteristics.

Create a custom policy

Veracode Package Firewall uses an Open Policy Agent (OPA)-based framework to evaluate dependencies and provide tailored results. You can create and apply custom policies by using the Rego query language. Software Development Kit (SDK) is available to help integrate these capabilities into your workflow.

note

Custom policies aren't related to Veracode security policies.

Create a basic policy

Use this basic policy with an issue rule to block all High and Critical issues.

# METADATA
# title: Limit risk
# description: |
#   Block issues based on risk level.
package policy.v1

import data.phylum.level
import rego.v1

# METADATA
# title: risk level cannot exceed medium
deny contains issue if {
    some issue in data.issues
    issue.severity > level.MEDIUM
}

The title and description in the initial metadata comments are displayed in the Package Firewall UI, and we highly recommend including them.

The package policy.v1 line must be present because it enables OPA to locate the policy rules.

The deny rule includes the specified issue when the if statement evaluates to true. OPA iterates through the job input data and evaluates the expression against the severity level of each issue in the job.

The title field in the metadata comment above the rule is associated with the failure in the output from Package Firewall.

Policy examples

A policy transforms your threat model into a description of why a job is blocked. There are multiple ways to define the conditions that block a job.

The METADATA block contains OPA annotations, which correlate to the schema and support type checking.

Block an issue

The most common reason to block a job is that one of the dependencies has a known issue in one of Package Firewall’s risk domains.

The following example shows how to block based on a per-domain threshold by using an issue rule.

package policy.v1

import data.phylum.domain
import data.phylum.level
import rego.v1

# METADATA
# title: risk level cannot exceed medium
deny contains issue if {
    some issue in data.issues
    issue.domain in {domain.AUTHOR, domain.ENGINEERING, domain.VULNERABILITY}
    issue.severity > level.MEDIUM
}

# METADATA
# title: malicious risk level cannot exceed low
deny contains issue if {
    some issue in data.issues
    issue.domain == domain.MALICIOUS
    issue.severity > level.LOW
}

# METADATA
# title: license risk level cannot exceed high
deny contains issue if {
    some issue in data.issues
    issue.domain == domain.LICENSE
    issue.severity > level.HIGH
}

Given the following input:

{
    "issues": [{
        "id": "b8ad4443-d875-427b-9eda-b4b2fb1d6212",
        "domain": "malicious",
        "severity": 4,
        "tag": "CM0004"
    }]
}

If the policy fails, the output appears similar to the following:

{
    "deny": [{
        "id": "b8ad4443-d875-427b-9eda-b4b2fb1d6212",
        "domain": "malicious",
        "severity": 4,
        "tag": "CM0004"
    }]
}

When Package Firewall receives this output from the policy, it blocks the job and generates a report that identifies the package and describes the issue.

Block a dependency

You can also block based on dependency-level characteristics by using a dependency rule.

The following example blocks packages that belong to a specific namespace.

Example: A policy already exists for blocking copyleft licenses. For details, see the copyleft license policy.

package policy.v1

import rego.v1

# METADATA
# title: AGPL licensed software is not allowed.
deny contains dependency if {
    some dependency in data.dependencies
    regex.match("(?i)\\bAGPL\\b", dependency.license)
}

Given the following input:

{
    "dependencies": [{
        "ecosystem": "npm",
        "id": "4cc36d79-b8ce-5b7d-89c1-6f6a31f59819",
        "issues": [],
        "issues_complete": true,
        "license": "AGPL-3.0",
        "name": "example-package",
        "version": "1.0.0"
    }]
}

If the policy fails, the output appears similar to the following:

{
  "deny": [{
        "ecosystem": "npm",
        "id": "4cc36d79-b8ce-5b7d-89c1-6f6a31f59819",
        "issues": [],
        "issues_complete": true,
        "license": "AGPL-3.0",
        "name": "example-package",
        "version": "1.0.0"
    }]
}

When Package Firewall receives this output from the policy, it blocks the package download.

Add a custom policy

You can add a custom policy to Package Firewall. After you add it, it is available across all the firewalls that you have. See here for instructions on creating a custom policy.

To complete this task:

1. Sign in to the Veracode Platform.
2. Select Policies > Firewall.
3. Select UPLOAD POLICY.
4. Drag your policy file into the screen or select the policy file from the File Explorer. If a valid Rego file is uploaded, the interface prompts you to verify the title, version, and description. Review the details and update them if needed.
5. Select CONFIRM. The metadata is updated according to the title, version, and description provided.
6. Select SUBMIT.

Remove a custom policy

You can remove a custom policy from Package Firewall.

Before you begin:

• The custom policy that you want to remove must be inactive in all of your firewalls.

To complete this task:

1. Sign in to the Veracode Platform.
2. Select Policies > Firewall.
3. Select the firewall for which you want to modify the policy.
4. Select the Policy tab.
5. Navigate to the custom policy that you want to remove, then select the delete icon.
6. On the popup, select DELETE.