Truth in IT
    • Sign In
    • Register
        • Videos
        • Channels
        • Pages
        • Galleries
        • News
        • Events
        • All
Truth in IT Truth in IT
  • Data Management ▼
    • Converged Infrastructure
    • DevOps
    • Networking
    • Storage
    • Virtualization
  • Cybersecurity ▼
    • Application Security
    • Backup & Recovery
    • Data Security
    • Identity & Access Management (IAM)
    • Zero Trust
    • Compliance & GRC
    • Endpoint Security
  • Cloud ▼
    • Hybrid Cloud
    • Private Cloud
    • Public Cloud
  • Webinar Library
  • TiPs
  • DRAW
  • CPE

Securing Dependencies: Version Pinning & Cooldowns

Fortra
08/11/2026
0 (0%)
Share
  • Comments
  • Download
  • Transcript
Report Like Favorite
  • Share/Embed
  • Email
Link
Embed

Transcript


writing code, it would take forever to get to product. So we have dependencies, we have libraries for all these different reasons that are to make our lives easier. But now we have to draw a line between making our life easier and keeping our users of our product secure. And I think that's the the interesting thing to me where we get into those two things that I talked about at the top of the show that make a really big difference. And to me, those are version pinning and dependency cooldowns. And I think those two things are king when it comes to how are you going to deal with and protect against this.

TL;DR

  • Modern development relies heavily on third-party libraries and dependencies to accelerate product delivery, but this convenience introduces significant security risks that must be actively managed.
  • Version pinning locks dependencies to specific versions, preventing automatic updates that could introduce vulnerabilities or breaking changes into production environments.
  • Dependency cooldowns involve waiting periods before adopting new dependency versions, allowing time for the security community to identify and disclose potential vulnerabilities before they reach your codebase.

Summary

This brief segment addresses the security challenges inherent in modern software development's reliance on third-party dependencies and libraries. While these components accelerate development by eliminating the need to build everything from scratch, they introduce security risks that must be actively managed. The speaker emphasizes the critical balance between developer productivity and user security, advocating for two specific practices: version pinning (locking dependencies to specific versions rather than accepting automatic updates) and dependency cooldowns (waiting periods before adopting new dependency versions to allow vulnerabilities to surface). These strategies represent a pragmatic approach to supply chain security, acknowledging that convenience cannot come at the expense of protecting end users from potential vulnerabilities introduced through the software supply chain.

Chapters

0:00 - The Dependency Dilemma
0:14 - Balancing Productivity and Security
0:30 - Version Pinning and Cooldowns

Key Quotes

0:14 "But now we have to draw a line between making our life easier and keeping our users of our product secure."
0:30 "And to me, those are version pinning and dependency cooldowns."

FAQ

What is version pinning and why does it matter for security?

Version pinning is the practice of locking your project's dependencies to specific versions rather than allowing automatic updates to the latest versions. This matters for security because it gives you control over when and how dependencies change, preventing malicious or vulnerable code from automatically entering your application through dependency updates. It allows you to evaluate new versions before adoption rather than accepting them blindly.

Categories:
  • » Cybersecurity » Application Security
  • » Data Protection
Channels:
News:
Events:
Tags:
  • Application Security
  • DevSecOps
  • Best Practices
  • Technical Deep Dive
  • Software Supply Chain Security
  • Dependency Management
  • Version Pinning
  • Dependency Cooldowns
  • Secure Development Practices
  • Third-Party Libraries
Show more Show less

Browse videos

  • Related
  • Featured
  • By date
  • Most viewed
  • Top rated
  •  

              Video's comments: Securing Dependencies: Version Pinning & Cooldowns

              View CPE Certificates

              Upcoming 360 View Events

              • Nov
                19

                Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection

                11/19/202601:00 PM ET
                More events

                XStreaminars (watch here)

                • Nov
                  12

                  Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision

                  11/12/202601:00 PM ET
                  More events

                  Industry Events (Sponsor Hosted)

                  • Nov
                    12

                    Hands-On Workshop: Connecting On-Prem Data to Databricks Using MinIO AIStor (Americas)

                    11/12/202601:00 PM ET
                    • Nov
                      18

                      Practical Session: Connecting On-Prem Data to Databricks via MinIO AIStor

                      11/18/202608:00 AM ET
                      • Nov
                        19

                        Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents

                        11/19/202601:00 PM ET
                        • Nov
                          19

                          A Deep Dive into Muse, Dots, and Duet's Impact on Your Website

                          11/19/202601:00 PM ET
                          • Dec
                            03

                            CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era

                            12/03/202601:00 PM ET
                            More events

                            Upcoming Webinar Calendar

                            • 11/12/2026
                              01:00 PM
                              11/12/2026
                              Leaving VMware Means Leaving vSAN: Your VMware Exit Is Really a Storage Decision
                              https://www.truthinit.com/index.php/channel/2192/leaving-vmware-means-leaving-vsan-your-vmware-exit-is-really-a-storage-decision/
                            • 11/12/2026
                              01:00 PM
                              11/12/2026
                              Hands-On Workshop: Connecting On-Prem Data to Databricks Using MinIO AIStor (Americas)
                              https://www.truthinit.com/index.php/channel/2202/hands-on-workshop-connecting-on-prem-data-to-databricks-using-minio-aistor-americas/
                            • 11/18/2026
                              08:00 AM
                              11/18/2026
                              Practical Session: Connecting On-Prem Data to Databricks via MinIO AIStor
                              https://www.truthinit.com/index.php/channel/2194/practical-session-connecting-on-prem-data-to-databricks-via-minio-aistor/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              Securing the Microsoft Enterprise: Strengthening Configuration Management, Identity Security, and Data Protection
                              https://www.truthinit.com/index.php/channel/2076/securing-the-microsoft-enterprise-strengthening-configuration-management-identity-security-and-data-protection/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              Zendesk Deep Dive: Get the work done faster with Employee Service AI Agents
                              https://www.truthinit.com/index.php/channel/2181/zendesk-deep-dive-get-the-work-done-faster-with-employee-service-ai-agents/
                            • 11/19/2026
                              01:00 PM
                              11/19/2026
                              A Deep Dive into Muse, Dots, and Duet's Impact on Your Website
                              https://www.truthinit.com/index.php/channel/2228/a-deep-dive-into-muse-dots-and-duets-impact-on-your-website/
                            • 12/03/2026
                              01:00 PM
                              12/03/2026
                              CISO Insights: Steering Cybersecurity Strategies in an AI-Driven Era
                              https://www.truthinit.com/index.php/channel/2231/ciso-insights-steering-cybersecurity-strategies-in-an-ai-driven-era/
                            • 01/19/2027
                              02:00 PM
                              01/19/2027
                              HUMAN Dialogue: Embracing the Rise of the Empowered AI Consumer.
                              https://www.truthinit.com/index.php/channel/2160/human-dialogue-embracing-the-rise-of-the-empowered-ai-consumer/
                            • 03/18/2027
                              01:00 PM
                              03/18/2027
                              Securing Access for People, Partners and AI Agents
                              https://www.truthinit.com/index.php/channel/2251/securing-access-for-people-partners-and-ai-agents/
                            • 06/17/2027
                              01:00 PM
                              06/17/2027
                              Stop the Leak: Data Loss Prevention for the AI Era
                              https://www.truthinit.com/index.php/channel/955/360view-stop-the-leak-data-loss-prevention-for-the-ai-era/
                            • 08/19/2027
                              01:00 PM
                              08/19/2027
                              Who Has Access to What...and Should They?
                              https://www.truthinit.com/index.php/channel/2252/who-has-access-to-what-and-should-they/
                            • 10/21/2027
                              01:00 PM
                              10/21/2027
                              After VMware: Building the Private Cloud You Actually Want
                              https://www.truthinit.com/index.php/channel/2253/after-vmware-building-the-private-cloud-you-actually-want/
                            • 11/18/2027
                              01:00 PM
                              11/18/2027
                              Assume Breach, Prove Recovery
                              https://www.truthinit.com/index.php/channel/2254/assume-breach-prove-recovery/
                            • 12/16/2027
                              01:00 PM
                              12/16/2027
                              The Self-Running Service Desk
                              https://www.truthinit.com/index.php/channel/2255/the-self-running-service-desk/
                            Truth in IT
                            • Sponsor
                            • About Us
                            • Terms of Service
                            • Privacy Policy
                            • Contact Us
                            • Preference Management
                            Desktop version
                            Standard version