In this chapter, we consider false data injection (FDI) attacks targeting the actuator or sensor in feedback control systems. It is well known that such attacks may cause significant physical damage. We employ basic principles of linear feedback systems to characterize when the attacks have a physical impact and simultaneously are stealthy. A conclusion is that unstable plants are always sensitive to sensor attacks, and non-minimum phase plants are always sensitive to actuator attacks. Also benign stable and minimum-phase plants may be vulnerable if the control system bandwidth is high. We derive some general guidelines for determining system vulnerability and illustrate their use on a case study. Finally, we discuss some defense mechanism based on watermarking, coding, and loop shifts.