By allowing storage communications to run on top of Transmission Control Protocol/Internet Protocol (TCP/IP) with a Storage Area Network (SAN), the

Running storage communications over TCP/IP does not inherently protect confidentiality; without additional encryption mechanisms like IPsec, the traffic is transmitted in cleartext and is vulnerable to interception.

When SAN traffic travels over standard TCP/IP networks using protocols like iSCSI, it is subject to the same passive interception risks as any other IP-based traffic. Without encryption (such as IPsec or TLS), an attacker with access to the network path can use a packet sniffer to capture raw storage I/O data, including sensitive file contents and credentials, because the traffic is not inherently confidential at the transport layer.

TCP/IP-based SANs are actually more susceptible to identity spoofing attacks (such as iSCSI initiator name spoofing) compared to Fibre Channel SANs that use WWN zoning, so the opportunity for spoofing is not eliminated.

Placing storage communications on TCP/IP networks exposes storage devices to network-based availability attacks such as Denial of Service (DoS), meaning availability protection is not provided and may in fact be reduced compared to isolated SAN fabrics.