Index: /trunk/doc/manual/en_US/user_Security.xml
===================================================================
--- /trunk/doc/manual/en_US/user_Security.xml	(revision 35290)
+++ /trunk/doc/manual/en_US/user_Security.xml	(revision 35290)
@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE chapter PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
+"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
+<chapter id="Troubleshooting">
+  <title>Security considerations</title>
+
+  <sect1>
+    <title>Potentially insecure operations</title>
+
+    <para>The following features of VirtualBox can present security
+    problems:<itemizedlist>
+        <listitem>
+          <para>Enabling 3D graphics via the Guest Additions exposes the host
+          to additional security risks; see <xref
+          linkend="guestadd-3d" />.</para>
+        </listitem>
+
+        <listitem>
+          <para>When teleporting a machine, the data stream through which the
+          machine's memory contents are transferred from one host to another
+          is not encrypted. A third party with access to the network through
+          which the data is transferred could therefore intercept that
+          data.</para>
+        </listitem>
+
+        <listitem>
+          <para>When using the VirtualBox web service to control a VirtualBox
+          host remotely, connections to the web service (through which the API
+          calls are transferred via SOAP XML) are not encrypted, but use plain
+          HTTP. For details about the web service, please see <xref
+          linkend="VirtualBoxAPI" />.</para>
+        </listitem>
+      </itemizedlist></para>
+  </sect1>
+
+  <sect1>
+    <title>Authentication</title>
+
+    <para>The following components of VirtualBox can use passwords for
+    authentication:<itemizedlist>
+        <listitem>
+          <para>When using the VirtualBox extension pack provided by Oracle
+          for VRDP remote desktop support, you can optionally use various
+          methods to configure RDP authentication. See <xref
+          linkend="vbox-auth" /> for details.</para>
+        </listitem>
+
+        <listitem>
+          <para>When using teleporting, passwords can optionally be used to
+          protect a machine waiting to be teleported from unauthorized access.
+          Note however that these passwords are stored <emphasis
+          role="bold">unencrypted</emphasis> in the machine configuration XML
+          and therefore potentially readable on the host. See <xref
+          linkend="teleporting" /> and <xref
+          linkend="vboxmanage-modifyvm-teleport" />.</para>
+        </listitem>
+
+        <listitem>
+          <para>When using remote iSCSI storage and the storage server is
+          requires authentication, a password can optionally be supplied with
+          the <computeroutput>VBoxManage storageattach</computeroutput>
+          command. Note however that this is stored <emphasis
+          role="bold">unencrypted</emphasis> in the machine configuration and
+          is therefore potentially readable on the host. See <xref
+          linkend="storage-iscsi" /> and <xref
+          linkend="vboxmanage-storageattach" />.</para>
+        </listitem>
+
+        <listitem>
+          <para>When using the VirtualBox web service to control a VirtualBox
+          host remotely, connections to the web service are authenticated in
+          various ways. This is described in detail in the VirtualBox Software
+          Development Kit (SDK) reference; please see <xref
+          linkend="VirtualBoxAPI" />.</para>
+        </listitem>
+      </itemizedlist></para>
+  </sect1>
+
+  <sect1>
+    <title>Encryption</title>
+
+    <para>The following components of VirtualBox use encryption to protect
+    sensitive data:<itemizedlist>
+        <listitem>
+          <para>When using the VirtualBox extension pack provided by Oracle
+          for VRDP remote desktop support, RDP data can optionally be
+          encrypted. See <xref linkend="vrde-crypt" /> for details.</para>
+        </listitem>
+      </itemizedlist></para>
+  </sect1>
+</chapter>