Credential Vaulting

The vault holds every administrative credential in the organisation, which makes it the most sensitive system you operate and the one with the highest availability requirement.

What the vault must provide

Encryption at rest with keys not stored alongside the data.

Strong authentication for access, with multi-factor as a requirement rather than an option.

Authorisation per credential, so that access to one does not imply access to all.

Full audit of every retrieval, including failed attempts.

Rotation, automated, on a schedule and on demand.

High availability, because an unavailable vault means administrators cannot work.

A recovery path that does not depend on the vault itself.

The checkout model

Exclusive checkout: one person at a time holds the credential, which gives clean attribution and creates contention.

Concurrent checkout: several people may hold it, which is operationally easier and weakens attribution.

Rotate on check-in: the credential changes after each use, which limits the value of a captured one and requires reliable rotation.

Brokered session: the credential is never revealed, and the vault establishes the session on the user's behalf. The strongest model and the one to prefer wherever the target system supports it.

Rotation

Scheduled rotation for everything, at an interval matched to the tier.

Rotation on check-in for the highest tiers.

Rotation on demand after any suspected exposure, tested so that it works under pressure.

The dependency problem is the blocker, and it is the service account problem described elsewhere. Human accounts rotate easily; accounts something depends on do not.

Verify rotation succeeded, because a silent failure leaves a credential everyone believes has changed.

Onboarding systems

Start with tier zero, the smallest population and the largest consequence.

Then the systems with the most administrators, which is where attribution is worst.

Then by ease, which is a legitimate criterion once the important ones are done.

Record what cannot be onboarded and why, because that list is the residual risk and it will otherwise be forgotten.

What makes administrators use it

The deployment succeeds or fails here.

Speed. If retrieval takes longer than the alternative, the alternative persists.

Availability. One outage during an incident produces a permanent workaround.

No double authentication where single sign-on can be used.

A path that works from where they actually work, including remotely.

Involvement in the design. Administrators know which workflows will break and will say so if asked.

Protecting the vault itself

Its own administrators are tier zero, and should be few, named, and monitored.

Access to the vault's host and database is equivalent to access to the vault.

Backups of the vault contain every credential and need the same protection as the vault.

Alert on vault administrative actions to a destination the vault administrators do not control.

Have a documented recovery procedure for total vault loss, and test it, because the failure mode is losing every administrative credential simultaneously.

Onboarding the first system

The first is slow and sets the pattern for everything after, so it is worth doing deliberately.

Choose a tier zero system with a small administrator population.

Discover every account on it, including local and emergency ones.

Decide per account: vault, remove, or convert to just-in-time.

Establish the brokered path and have an administrator use it for real work.

Enforce the path at the network and host level.

Document the break-glass route and test it.

Write down what you learned, because the second system of the same class takes a fraction of the time if the pattern is recorded.

Protecting the vault's own dependencies

The vault inherits the security of everything it depends on, which is frequently overlooked.

Its host and operating system.

Its database, which contains the encrypted secrets.

Its backups, which contain the same.

Its authentication path, typically the directory.

Its encryption keys, which must not be stored with the data.

Its administrators, who are tier zero by definition.

Each of these is an alternative route to the vault's contents, and a deployment that hardens the application while leaving the database accessible has not protected anything.