Glossary · OT security engineering
Password vault
Also known as: Credential vault, Password manager (enterprise)
German: Passworttresor
In access management, a password vault is an encrypted, access-controlled repository that stores passwords, keys and other credentials, releases them only to authorized users or systems, and logs their use. It is often part of a privileged access management solution.
- Security engineering
- OT security
In one sentence
A password vault is an encrypted, access-controlled store that holds credentials, releases them only to authorized users and logs their use.
Example
The administrator passwords of all PLCs and switches are stored in the password vault; a technician checks one out for a maintenance task and the vault rotates it afterward.
How it applies
- Engineering: OT devices often have local accounts that cannot use central authentication. A password vault replaces spreadsheets and labels on cabinets with controlled storage, unique passwords per device and logging of who used which credential.
- Operation: Check-out and check-in workflows, approval steps and automatic rotation after use reduce the risk of shared or leaked passwords.
- Maintenance: The vault itself becomes critical: if it is unavailable, no one can log on to devices. Plan emergency access ("break glass") and include the vault in Disaster recovery.
- Documentation: Commissioning procedures should instruct that default passwords are changed and the new credentials stored in the vault, never in the handover documents. Manuals should say which accounts a device has and whether their passwords can be changed.
Password vault vs. password manager
A personal password manager stores one user's credentials. An enterprise password vault manages shared and privileged credentials of an organization with approval, rotation and audit functions.