NF – ISCSI – ISCSI auth message None – Mounted device on Internal net – Auth None used – Data in clear txt
This alert is triggered when an iSCSI authentication message with "AuthMethod=None" is detected from an internal device to an external network. This indicates that an iSCSI connection is being established with no authentication.
ID Number
5013703
Signature
alert tcp $HOME_NET 1023: -> $EXTERNAL_NET 3260 (msg:"NF - ISCSI - ISCSI auth message None - Mounted device on Internal net - Auth None used - Data in clear txt"; flags:PA; content:"AuthMethod=None"; nocase; reference:url,networkforensic.dk; metadata:13122018; classtype:policy-violation; sid:5013703; rev:1;)
Severity
High
Recommendations/Investigative actions
Enforce secure authentication methods for iSCSI connections to prevent unauthorized access.
Block unauthenticated iSCSI traffic.