{"id":24730,"date":"2023-05-01T18:42:13","date_gmt":"2023-05-01T18:42:13","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/"},"modified":"2026-08-08T04:54:38","modified_gmt":"2026-08-08T04:54:38","slug":"is-memory-safety-the-killer-use-case-for-software-bills-of-materials","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/","title":{"rendered":"Is \u2018memory safety\u2019 the killer use case for SBOMs?"},"content":{"rendered":"\n

Last year, Cybersecurity and Infrastructure Security Agency Director Jen Easterly gave a speech at Carnegie Mellon<\/a> that emphasized the \u201csecure by default\u201d future that federal agencies are aiming for when they talk about driving security into earlier phases of software design.<\/p>\n\n\n\n

What does this look like in practice, and how is this going to affect the federal government\u2019s software procurement policies? Those are the types of questions that federal agencies and their software providers alike are asking as they brace for the new world of \u201csoftware bills of materials\u201d (aka \u201cSBOMs\u201d) and their disclosure requirements<\/a>.<\/p>\n\n\n\n

If you want a front-row seat to watch the federal government\u2019s effort to make software \u201csecure by default\u201d in the next two years, memory safety is a great class of software vulnerability to watch. Let\u2019s take a look.<\/p>\n\n\n\n

What is memory safety?<\/h2>\n\n\n\n

Memory safety is a particularly ripe domain for software vulnerabilities. So much so that back in November, the National Security Agency issued guidance<\/a> to \u201chelp software developers and operators prevent and mitigate software memory safety issues, which account for a large portion of exploitable vulnerabilities.\u201d<\/p>\n\n\n\n

Most low-level programming languages–like C++ and C–are memory unsafe. Developers have to manually configure and allocate the machine\u2019s memory. If you make a mistake, your program can read or write data from the wrong type of memory. And that leads to bugs, crashes, data leaks and all kinds of potential exploits.<\/p>\n\n\n\n

Dealing with memory safety in these low-level languages is something that gets taught in programming classes, but it\u2019s tedious, error prone and time-intensive work.<\/p>\n\n\n\n

Memory safety vulnerabilities include buffer overflows and use-after-free errors and have accounted for the majority of application security issues disclosed by software companies. Back in 2019, Microsoft revealed<\/a> that 70% of its common vulnerabilities and exposures, or CVEs, were caused by developers making memory corruption mistakes in their C and C++ code.<\/p>\n\n\n\n

Memory unsafe<\/h2>\n\n\n\n

According to Consumer Reports\u2019 Future of Memory Safety report<\/a>, \u201c60 to 70 percent of browser and kernel vulnerabilities\u2014and security bugs found in C\/C++ code bases\u2014are due to memory unsafety, many of which can be solved by using memory-safe languages.\u201d<\/p>\n\n\n\n

Memory-safe languages have been around for a long time. But up until recently, they weren\u2019t performant or scalable enough for low-level programming at the kernel or firmware level. And so a whole class of developers continued to use memory unsafe languages.<\/p>\n\n\n\n

The Rust programming language really burst onto the scene as the language that nailed developer primitives for memory and performance, and has radically changed how developers can approach low-level programming with memory safety guardrails.<\/p>\n\n\n\n

The Rust community has already reached 2 million developers and has become one of the most-loved of all programming languages<\/a>. Major players in the industry including Google have completed major rewrites in Rust, in the name of memory safety, including much of the critical backend infrastructure (HTTP and TLS) for Android.<\/p>\n\n\n\n

But what about all that other legacy code out there in production in the world\u2019s systems?<\/p>\n\n\n\n

Rewriting software is hard. It takes a lot of time, and it takes effort to convince management that it\u2019s a worthwhile investment. It\u2019s one thing for publicly funded government agencies and the world\u2019s largest tech companies with their deep pockets to rewrite for memory safety. But convincing the rest of the market, and under resourced open-source maintainers, to do the right thing is a major challenge.<\/p>\n\n\n\n

In its Cybersecurity Information Sheet on Software Memory Safety<\/a> released late last year, the NSA described this key challenge of driving the \u201cculture of software development towards utilizing memory safe languages.\u201d<\/p>\n\n\n\n

The power of SBOMs<\/h2>\n\n\n\n

The real power of SBOMs is their up-front value to the software procurement process. They provide the \u201clist of ingredients\u201d that has always been missing for software consumers to be able to make informed decisions on how a technology will affect their security posture.<\/p>\n\n\n\n

When we can attest to what\u2019s inside our software before we purchase it, now the laws of supply and demand economics should drive down our overall usage of software that is memory un-safe. If you are choosing which software to adopt and have multiple options, you are going to favor the software that wasn\u2019t written in a memory unsafe language like COBOL, because you want to avoid a weakened security posture.<\/p>\n\n\n\n

The NSA\u2019s National Cybersecurity Strategy<\/a> report described the federal commitment to SBOMs as central to an overall \u201csoftware supply chain risk mitigation objective.\u201d It also described its efforts to develop an \u201cadaptable safe harbor framework to shield from liability companies that securely develop and maintain their software products and services\u201d like the NIST Secure Software Development Framework, or SSDF<\/a>.<\/p>\n\n\n\n

The read-between-the-lines message here is that the federal government \u2014 the country\u2019s largest purchaser of software \u2014 will itself be using SBOMs to instruct security compliance for procurement, and then will pressure industry with the carrot of legal indemnity if they follow similar precautions.<\/p>\n\n\n\n

As SBOMs give first the government, then industry at large, the standard method to inspect software packages, markets will be able to galvanize much faster to weed out critical software vulnerabilities. Memory safety may be SBOMs first killer use case, but it will be equally interesting to watch how SBOMs play a role in the government\u2019s carrot-and-stick measures with legal indemnities and safe harbors.<\/p>\n\n\n\n

Dan Lorenc is CEO and co-founder of Chainguard. Previously he was staff software engineer and lead for Google\u2019s Open Source Security Team (GOSST). He has founded projects like Minikube, Skaffold, TektonCD, and Sigstore.<\/i><\/p>\n","protected":false},"excerpt":{"rendered":"

The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.<\/p>\n","protected":false},"author":7,"featured_media":48092,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":20,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10,29,16,24,20],"tags":[],"coauthors":[5755],"class_list":["post-24730","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber","category-home","category-it-networks","category-opinion","category-thought-leadership"],"acf":{"subheadline":"","legacy_arc_id":"YPYQGJJXCRAV7OKTLAML6BKKIQ","arc_canonical_url":"\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\nIs \u2018memory safety\u2019 the killer use case for SBOMs? - C4ISRNet<\/title>\n<meta name=\"description\" content=\"The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Is \u2018memory safety\u2019 the killer use case for SBOMs?\" \/>\n<meta property=\"og:description\" content=\"The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/\" \/>\n<meta property=\"og:site_name\" content=\"C4ISRNet\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-01T18:42:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-08T04:54:38+00:00\" \/>\n<meta name=\"author\" content=\"Dan Lorenc\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dan Lorenc\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\n\t \"@context\": \"https:\\\/\\\/schema.org\",\n\t \"@graph\": [\n\t {\n\t \"@type\": \"Article\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#article\",\n\t \"isPartOf\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/\"\n\t },\n\t \"author\": {\n\t \"name\": \"migration\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#\\\/schema\\\/person\\\/cc76c831bb37a926738c8391fca7a3b1\"\n\t },\n\t \"headline\": \"Is \u2018memory safety\u2019 the killer use case for SBOMs?\",\n\t \"datePublished\": \"2023-05-01T18:42:13+00:00\",\n\t \"dateModified\": \"2026-08-08T04:54:38+00:00\",\n\t \"mainEntityOfPage\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/\"\n\t },\n\t \"wordCount\": 929,\n\t \"commentCount\": 0,\n\t \"publisher\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#organization\"\n\t },\n\t \"image\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#primaryimage\"\n\t },\n\t \"thumbnailUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/programming-code.jpg.jpg\",\n\t \"articleSection\": [\n\t \"Cyber\",\n\t \"Home\",\n\t \"IT and Networks\",\n\t \"Opinion\",\n\t \"Thought Leadership\"\n\t ],\n\t \"inLanguage\": \"en-US\",\n\t \"potentialAction\": [\n\t {\n\t \"@type\": \"CommentAction\",\n\t \"name\": \"Comment\",\n\t \"target\": [\n\t \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#respond\"\n\t ]\n\t }\n\t ]\n\t },\n\t {\n\t \"@type\": \"WebPage\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/\",\n\t \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/\",\n\t \"name\": \"Is \u2018memory safety\u2019 the killer use case for SBOMs? - C4ISRNet\",\n\t \"isPartOf\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#website\"\n\t },\n\t \"primaryImageOfPage\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#primaryimage\"\n\t },\n\t \"image\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#primaryimage\"\n\t },\n\t \"thumbnailUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/programming-code.jpg.jpg\",\n\t \"datePublished\": \"2023-05-01T18:42:13+00:00\",\n\t \"dateModified\": \"2026-08-08T04:54:38+00:00\",\n\t \"description\": \"The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.\",\n\t \"breadcrumb\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#breadcrumb\"\n\t },\n\t \"inLanguage\": \"en-US\",\n\t \"potentialAction\": [\n\t {\n\t \"@type\": \"ReadAction\",\n\t \"target\": [\n\t \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/\"\n\t ]\n\t }\n\t ]\n\t },\n\t {\n\t \"@type\": \"ImageObject\",\n\t \"inLanguage\": \"en-US\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#primaryimage\",\n\t \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/programming-code.jpg.jpg\",\n\t \"contentUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/programming-code.jpg.jpg\"\n\t },\n\t {\n\t \"@type\": \"BreadcrumbList\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/2023\\\/05\\\/01\\\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\\\/#breadcrumb\",\n\t \"itemListElement\": [\n\t {\n\t \"@type\": \"ListItem\",\n\t \"position\": 1,\n\t \"name\": \"Home\",\n\t \"item\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/\",\n\t \"ad_zone\": \"home\"\n\t },\n\t {\n\t \"@type\": \"ListItem\",\n\t \"position\": 2,\n\t \"name\": \"Thought Leadership\",\n\t \"item\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/thought-leadership\\\/\",\n\t \"ad_zone\": \"thought-leadership\"\n\t },\n\t {\n\t \"@type\": \"ListItem\",\n\t \"position\": 3,\n\t \"name\": \"Is \u2018memory safety\u2019 the killer use case for SBOMs?\"\n\t }\n\t ]\n\t },\n\t {\n\t \"@type\": \"WebSite\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#website\",\n\t \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/\",\n\t \"name\": \"C4ISRNet\",\n\t \"description\": \"Media for the Intelligence-Age Military | C4ISRNET\",\n\t \"publisher\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#organization\"\n\t },\n\t \"potentialAction\": [\n\t {\n\t \"@type\": \"SearchAction\",\n\t \"target\": {\n\t \"@type\": \"EntryPoint\",\n\t \"urlTemplate\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/?s={search_term_string}\"\n\t },\n\t \"query-input\": {\n\t \"@type\": \"PropertyValueSpecification\",\n\t \"valueRequired\": true,\n\t \"valueName\": \"search_term_string\"\n\t }\n\t }\n\t ],\n\t \"inLanguage\": \"en-US\"\n\t },\n\t {\n\t \"@type\": \"Organization\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#organization\",\n\t \"name\": \"C4ISRNet\",\n\t \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/\",\n\t \"logo\": {\n\t \"@type\": \"ImageObject\",\n\t \"inLanguage\": \"en-US\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#\\\/schema\\\/logo\\\/image\\\/\",\n\t \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c4isrnet-logo-white.png\",\n\t \"contentUrl\": \"https:\\\/\\\/one.sightlinemg.com\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/c4isrnet-logo-white.png\",\n\t \"caption\": \"C4ISRNet\"\n\t },\n\t \"image\": {\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#\\\/schema\\\/logo\\\/image\\\/\"\n\t }\n\t },\n\t {\n\t \"@type\": \"Person\",\n\t \"@id\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/#\\\/schema\\\/person\\\/cc76c831bb37a926738c8391fca7a3b1\",\n\t \"name\": \"migration\",\n\t \"image\": {\n\t \"@type\": \"ImageObject\",\n\t \"inLanguage\": \"en-US\",\n\t \"@id\": \"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=gcf4cb6ee0ec29e49e7a963234e4340ec\",\n\t \"url\": \"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g\",\n\t \"contentUrl\": \"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g\",\n\t \"caption\": \"migration\"\n\t },\n\t \"url\": \"https:\\\/\\\/one.sightlinemg.com\\\/c4isrnet\\\/author\\\/migration\\\/\"\n\t }\n\t ]\n\t}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Is \u2018memory safety\u2019 the killer use case for SBOMs? - C4ISRNet","description":"The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Is \u2018memory safety\u2019 the killer use case for SBOMs?","og_description":"The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.","og_url":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/","og_site_name":"C4ISRNet","article_published_time":"2023-05-01T18:42:13+00:00","article_modified_time":"2026-08-08T04:54:38+00:00","author":"Dan Lorenc","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Dan Lorenc","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#article","isPartOf":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/"},"author":{"name":"migration","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#\/schema\/person\/cc76c831bb37a926738c8391fca7a3b1"},"headline":"Is \u2018memory safety\u2019 the killer use case for SBOMs?","datePublished":"2023-05-01T18:42:13+00:00","dateModified":"2026-08-08T04:54:38+00:00","mainEntityOfPage":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/"},"wordCount":929,"commentCount":0,"publisher":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#organization"},"image":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#primaryimage"},"thumbnailUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/programming-code.jpg.jpg","articleSection":["Cyber","Home","IT and Networks","Opinion","Thought Leadership"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/","url":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/","name":"Is \u2018memory safety\u2019 the killer use case for SBOMs? - C4ISRNet","isPartOf":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#website"},"primaryImageOfPage":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#primaryimage"},"image":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#primaryimage"},"thumbnailUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/programming-code.jpg.jpg","datePublished":"2023-05-01T18:42:13+00:00","dateModified":"2026-08-08T04:54:38+00:00","description":"The federal government \u2014 the country\u2019s largest purchaser of software \u2014 will be using SBOMs to instruct security compliance for procurement.","breadcrumb":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#primaryimage","url":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/programming-code.jpg.jpg","contentUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/programming-code.jpg.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/2023\/05\/01\/is-memory-safety-the-killer-use-case-for-software-bills-of-materials\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/one.sightlinemg.com\/c4isrnet\/","ad_zone":"home"},{"@type":"ListItem","position":2,"name":"Thought Leadership","item":"https:\/\/one.sightlinemg.com\/c4isrnet\/thought-leadership\/","ad_zone":"thought-leadership"},{"@type":"ListItem","position":3,"name":"Is \u2018memory safety\u2019 the killer use case for SBOMs?"}]},{"@type":"WebSite","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#website","url":"https:\/\/one.sightlinemg.com\/c4isrnet\/","name":"C4ISRNet","description":"Media for the Intelligence-Age Military | C4ISRNET","publisher":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/one.sightlinemg.com\/c4isrnet\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#organization","name":"C4ISRNet","url":"https:\/\/one.sightlinemg.com\/c4isrnet\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#\/schema\/logo\/image\/","url":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/06\/c4isrnet-logo-white.png","contentUrl":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/06\/c4isrnet-logo-white.png","caption":"C4ISRNet"},"image":{"@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/one.sightlinemg.com\/c4isrnet\/#\/schema\/person\/cc76c831bb37a926738c8391fca7a3b1","name":"migration","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=gcf4cb6ee0ec29e49e7a963234e4340ec","url":"https:\/\/secure.gravatar.com\/avatar\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/9e8d47be443ce94ce7fc357677b5f9c70235bb1f59e7267a102a74af58c04f59?s=96&d=mm&r=g","caption":"migration"},"url":"https:\/\/one.sightlinemg.com\/c4isrnet\/author\/migration\/"}]}},"jetpack_sharing_enabled":true,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"C4ISRNet","distributor_original_site_url":"https:\/\/one.sightlinemg.com\/c4isrnet","push-errors":false,"jetpack_featured_media_url":"https:\/\/one.sightlinemg.com\/wp-content\/uploads\/2026\/08\/programming-code.jpg.jpg","_links":{"self":[{"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/posts\/24730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/comments?post=24730"}],"version-history":[{"count":1,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/posts\/24730\/revisions"}],"predecessor-version":[{"id":24735,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/posts\/24730\/revisions\/24735"}],"wp:attachment":[{"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/media?parent=24730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/categories?post=24730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/tags?post=24730"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/one.sightlinemg.com\/c4isrnet\/wp-json\/wp\/v2\/coauthors?post=24730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}