Glossary · Industrial cybersecurity
Credential
In cybersecurity, a credential is information or a cryptographic item used to authenticate an identity or enable access, such as a password, a PIN, a key card, a private key or a certificate.
- Cybersecurity
- Standards
In one sentence
A credential is a password, key, token or certificate used to authenticate an identity or enable access to a machine or system.
Example
Each drive controller on an integrated production line has its own device certificate as a credential, so that the safety PLC only accepts configuration data from identified devices.
How it applies
- Cybersecurity: Credentials need a lifecycle: issue, store securely, rotate, revoke. Default and hard-coded passwords are a common weakness in machines and are addressed by the CRA's requirement for secure-by-default configurations.
- Machine safety: A mechanical key for a mode selector is also a credential. Treat keys, cards and passwords for safety-relevant functions with the same discipline as network credentials.
- Technical documentation: Manuals should explain how to change initial credentials at commissioning, how to handle lost credentials and who may hold which. Never print real passwords in documentation.
- Remote access: Personal credentials, not shared service accounts, make remote access traceable to a person.
Credential vs. authentication
A credential is what is presented. Authentication is the process of verifying it. Strong authentication fails if credentials are shared, written on the control cabinet or never revoked; authorization then decides what the verified identity may do.