Vaulting, Credential Management, and Rotation
Vaulting concepts
Credentials are stored as managed accounts within managed systems, grouped into functional accounts and organized by asset groups and policy sets. A credential record includes the account name, the secret, rotation settings, and checkout policy. Encryption protects secrets at rest; access is mediated by policy, not file permissions.
Rotation
Rotation is the automated change of a password on a schedule or on demand. Key parameters: rotation interval, rotation policy, verification (confirm the new password works), and reconciliation (bring the vault and target back into sync when they diverge). Understand the difference between change (set a new password) and verify (test the stored one). Failed verification should trigger reconciliation, not silent failure.
Checkout and release
Checkout grants temporary access to a credential; release delivers the password to the user. Policies control whether the password is shown, for how long, and whether approval is required. Automatic release and manual release differ in who initiates delivery.
Traps
Candidates mix up reconciliation and rotation: reconciliation fixes a mismatch without necessarily changing the password on schedule. Another trap is assuming rotation happens on the user's machine - it is agent-driven. Also, a disabled rotation policy does not delete the credential.
Worked example
A password fails verification after a manual change on the server. The correct response is reconciliation: Password Safe detects the mismatch and re-syncs the vault to the target, rather than waiting for the next scheduled rotation.