I think you are on the right track. You could make two attributes in SystemSettings or elsewhere. One is the password, one is the comparison.
Set the password in the database or however you like but provide no access to it except maybe by the admin.
Create a form to update the comparison password. Set the attribute to a password type if desired.
UPDATE SystemSettings USING MyForm
IF Password<>Comparison THEN
REPORT ERROR 'Error...'
ELSE
Do something....