Skip to tutorial content
Rate module Not yet rated

Credential Rotation and Governance

4 min read
On this page

In this lesson, you will learn:

  • What a credential register holds
  • How to rotate without breaking scans
  • Who owns what

🔁 Quick look back: Last time: Nmap Credential-less Discovery. You learned what Nmap credential-less Discovery can do as a fallback.

1 The Problem: A Rotated Password Breaks Tonight’s Scan

Farah’s rule says passwords change every 90 days. If the password changes but ServiceNow isn’t updated:

  • Tonight’s scan fails for every Windows server.
  • Nobody knows until the morning.

🎯 The problem: A rotated password can break tonight’s scan.

👉 The fix: Keep a credential register and a rotation plan that updates ServiceNow at the same time.

Table from the credential register.
Figure 1. Part of the Clear View credential register.

2 The credential register

  • Each credential and its account.
  • Owner.
  • Rights (from the privilege matrix).
  • Last and next rotation dates.
  • Who updates ServiceNow.

3 Rotating safely

  1. Plan the rotation in a quiet window, not before a scan.
  2. Change the password and update ServiceNow together.
  3. Run Quick Discovery on one device to test.
  4. Update the register.

⭐ Remember: A rotation is a change. Use the normal change process.

4 Project Clear View: How We Implemented It

📍 Situation: svc-snow-disc is due for rotation in week 10, during rollout.

🧭 Decision: Plan it with Priya, and test straight after.

🛠️ Steps we took:

  1. Wrote the register with owners and dates.
  2. Booked the week-10 rotation for a Tuesday afternoon.
  3. Agreed Priya changes the password and you update ServiceNow in the same call.
  4. Planned a Quick Discovery test straight after.

✅ What we verified:

  • The register is complete.
  • The rotation plan is agreed and in the change calendar.

📁 Evidence: The Clear View credential register. The rotation is tested in Production Rollout › Go-Live Day.

5 Quick recap

  • Keep a register: credential, owner, rights, rotation dates.
  • Change the password and ServiceNow together.
  • Test with Quick Discovery straight after.
  • Treat rotation as a change.

6 Check yourself

Think of your answer first. Then tap to check.

1 What goes in a credential register? Show answer

Credential, account, owner, rights, rotation dates, who updates ServiceNow.

2 How do you avoid a rotation breaking scans? Show answer

Change the password and ServiceNow together, then test with Quick Discovery.

3 When is svc-snow-disc rotated? Show answer

Week 10.

Nice work! SNWR’s credentials are governed. 🎉
Next up: Guided Setup and Discovery Properties

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.