prior user

A relational security concept used to identify the source side of a resource-reuse threat: any principal — whether a human user, an assigned role, or a process acting on behalf of either — whose session has ended and whose allocated system resources (memory, cache, disk sectors, registers, etc.) have been returned to the system for reassignment. The concern is that information produced by the actions of prior users or roles may remain accessible to any current users or roles that obtain access to those shared system resources after the resources have been released back to the system. The phrase appears consistently in the object-reuse and residual-information-protection family of controls, where it anchors the threat model by naming the unintended originator of residual data, as opposed to the successor principal who must be denied access to it. This problem domain is commonly referred to as object reuse and residual information protection, covering shared resources such as registers, cache memory, main memory, and hard disks.