Editing ISCSI (section)

===Confidentiality and integrity===
For the most part, iSCSI operates as a cleartext protocol that provides no cryptographic protection for data in motion during SCSI transactions. As a result, an attacker who can listen in on iSCSI Ethernet traffic can:<ref>{{cite web|url=http://pubs.vmware.com/vsphere-4-esxi-installable-vcenter/index.jsp?topic=/com.vmware.vsphere.esxi_server_config.doc_41/esx_server_config/securing_an_esx_configuration/c_protecting_an_iscsi_san.html|title=Protecting an iSCSI SAN|publisher=VMware|access-date=3 November 2012|archive-url=https://web.archive.org/web/20160303201737/http://pubs.vmware.com/vsphere-4-esxi-installable-vcenter/index.jsp?topic=%2Fcom.vmware.vsphere.esxi_server_config.doc_41%2Fesx_server_config%2Fsecuring_an_esx_configuration%2Fc_protecting_an_iscsi_san.html|archive-date=3 March 2016|url-status=dead}}</ref>
* Reconstruct and copy the files and filesystems being transferred on the wire
* Alter the contents of files by injecting fake iSCSI frames
* Corrupt filesystems being accessed by initiators, exposing servers to software flaws in poorly tested filesystem code.

These problems do not occur only with iSCSI, but rather apply to any [[Storage area network|SAN]] protocol without cryptographic security. IP-based security protocols, such as [[IPsec]], can provide standards-based cryptographic protection to this traffic.