prior user
A relational security concept used to identify the source side of a resource-reuse threat: any principal — whether a human user, an assigned role, or a process acting on behalf of either — whose session has ended and whose allocated system resources (memory, cache, disk sectors, registers, etc.) have been returned to the system for reassignment. The concern is that information produced by the actions of prior users or roles may remain accessible to any current users or roles that obtain access to those shared system resources after the resources have been released back to the system. The phrase appears consistently in the object-reuse and residual-information-protection family of controls, where it anchors the threat model by naming the unintended originator of residual data, as opposed to the successor principal who must be denied access to it. This problem domain is commonly referred to as object reuse and residual information protection, covering shared resources such as registers, cache memory, main memory, and hard disks.
Framework senses
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A relational security concept used to identify the source side of a resource-reuse threat: any principal — whether a human user, an assigned role, or a process acting on behalf of either — whose session has ended and whose allocated system resources (memory, cache, disk sectors, registers, etc.) have been returned to the system for reassignment. The concern is that information produced by the actions of prior users or roles may remain accessible to any current users or roles that obtain access to those shared system resources after the resources have been released back to the system. The phrase appears consistently in the object-reuse and residual-information-protection family of controls, where it anchors the threat model by naming the unintended originator of residual data, as opposed to the successor principal who must be denied access to it. This problem domain is commonly referred to as object reuse and residual information protection, covering shared resources such as registers, cache memory, main memory, and hard disks.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.