If your NAS cannot encrypt its storage volume, secure it with layered controls: keep it behind a router, disable UPnP and DMZ exposure, use a VPN instead of published administration ports, require multifactor authentication, restrict users and firewall rules, turn off unused services, patch firmware and packages, encrypt connections, and maintain snapshots plus independent offline or off-site backups. These measures reduce intrusion and ransomware risk and improve recovery, but they do not encrypt data while the disks are removed or directly read.
What you lose without volume encryption
Storage-volume encryption protects data at rest. If someone removes a drive, accesses a disk outside the NAS, or obtains raw storage after disposal, encryption can prevent readable files without the encryption key. Network hardening, account controls and backups solve different problems: they reduce the chance that an attacker reaches the NAS, limits what a compromised account can do, protects data while it crosses a network, and helps you restore files after deletion or ransomware.
As an Amazon Associate I earn from qualifying purchases.
Do not treat encrypted transport as a substitute for at-rest encryption. HTTPS/TLS protects a management session in transit; SMB encryption or signing protects supported file-sharing traffic; SFTP or FTPS can protect suitable transfer workflows. None of these makes a powered-off disk unreadable.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use this priority order
| Control | Primary benefit | Main limitation |
|---|---|---|
| Router placement, VPN, segmentation and firewall rules | Reduces internet and lateral-network exposure | Cannot stop an already trusted, compromised client from using its permitted access |
| MFA, named accounts and lockout | Resists stolen-password and brute-force account takeover | Protection depends on coverage and the strength of the second factor |
| Snapshots | Provides fast local rollback after accidental deletion or some ransomware events | Snapshots remain on the NAS and can be deleted by an attacker with sufficient privileges |
| Offline, off-site or immutable backups | Separates recovery copies from a compromised NAS | Requires storage, rotation and restoration testing |
| HTTPS/TLS, SMB signing or encryption, SFTP/FTPS | Protects data and credentials in transit | Client and model compatibility varies; it does not protect data at rest |
1. Put the NAS behind the router
Connect it to your router, not directly to the modem
QNAP advises connecting the NAS to a router rather than directly to an ISP modem. The router provides stateful firewalling, private addressing and a place to apply network policy. A direct modem connection can expose management and file-sharing services to unsolicited internet traffic.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Disable UPnP and DMZ
Turn off UPnP on the router unless you have a documented, unavoidable need for it. UPnP can let devices request automatic port forwarding. Do not place the NAS in the router’s DMZ or use a one-click “expose host” setting. Create only the explicit forwarding rules you need; for administration, the preferred rule is no public forwarding at all.
Segment the NAS and restrict east-west traffic
Place the NAS on a trusted server or storage VLAN when your router or switch supports VLANs. Keep guest Wi-Fi and untrusted IoT devices on separate networks. Apply access-control lists or firewall rules so only approved workstation, backup and management networks can reach the NAS. Segmentation limits lateral movement, but it is not a complete barrier: a permitted client with malware can still modify shares.
2. Replace public NAS administration with a VPN
For remote administration or file access, terminate a VPN on the router, a dedicated gateway or another hardened endpoint. Use modern, strongly cryptographic VPN settings and require MFA for the VPN or the identity provider when supported. Connect to the private network first, then use the NAS’s normal private address.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not publish DSM, QTS, QuTS hero or other NAS administration ports directly to the internet. Avoid exposing generic web panels, SSH, Telnet, SMB or database ports. If a business workflow truly requires an internet-facing service, isolate it, restrict source addresses where possible, enforce TLS, monitor authentication and review whether a gateway or zero-trust access broker can remove direct exposure.
3. Require strong multifactor authentication
Cover every privileged path
Enable MFA for every NAS administrator and for remote-access accounts. Include the VPN, web administration portal and any identity provider that can reset NAS credentials. A password plus a second factor is materially stronger than a password alone, but an attacker can still exploit an account that was never enrolled or a recovery method that bypasses MFA.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prefer phishing-resistant factors
Where the NAS, identity provider and VPN support it, use a hardware-backed FIDO2/WebAuthn security key or hardware-based PKI authentication. CISA describes phishing-resistant MFA as a combination of credentials and a method such as FIDO authentication or hardware-based PKI. Support is implementation-dependent, so verify compatibility before buying a key or changing sign-in policy. Keep at least one securely stored spare and document account-recovery procedures.
Enable lockout and alerting
Use automatic blocking after repeated failed logins. Set a threshold and duration that stop password spraying without locking out every legitimate user after a typo. Review failed-login alerts, new administrator creation, privilege changes and unexpected VPN sessions.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →4. Build least-privilege accounts and permissions
Use named accounts
Create a separate named account for each person instead of sharing an administrator login. Keep one or more emergency administrator accounts protected with MFA, but do daily file work with standard accounts. Remove former employees, contractors and test accounts as soon as they are no longer needed.
Separate administration from file access
Do not give a user administrative rights merely because they need to read or write a share. Assign per-folder and per-application permissions, and make access groups reflect actual job duties. Review inherited permissions, hidden shares and application tokens; an old sync task can retain write access even after a user leaves.
Audit regularly
At least quarterly, compare active accounts and groups with current staff and services. Check which accounts can delete snapshots, change firewall rules, install packages or create new administrators. Record the owner and business purpose of every service account, then rotate its credential when ownership or scope changes.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Disable Telnet, SSH and unused services
Turn off Telnet and SSH unless an operational task requires them. Telnet provides no secure confidentiality. SSH is substantially safer, but an enabled shell still adds an attack surface and should be restricted to trusted administrator networks, limited source addresses and key-based authentication where the platform supports it. Disable unused file-sharing protocols, media servers, download tools, container interfaces and vendor remote-support features. Recheck after firmware upgrades because updates can re-enable defaults or add new services.
6. Configure the NAS firewall and automatic blocking
Start with an allow-list design
Define the networks that genuinely need access: management workstations, employee LANs, backup hosts and the VPN address pool. Allow only required ports from those sources, then deny other inbound traffic. Keep management ports narrower than file-sharing ports; for example, an administrator subnet may reach the web console while ordinary workstations can reach only the required SMB shares.
Use source, port and location filters carefully
Synology’s security controls support firewall filtering by source IP, range, port and location, along with allow/deny lists and IP auto-blocking. Names and available filters vary by DSM release and model. Put specific allow rules before broad deny rules, test from both an allowed and a denied network, and keep a local recovery path so a bad rule does not lock out every administrator.
Do not rely on geoblocking alone
Country filters can reduce noise but are not identity controls. Attackers may use cloud hosts or a compromised device inside an allowed country. Combine location filters with VPN-only administration, MFA and narrow source ranges.
7. Patch firmware, packages and security components
Enable automatic firmware and package updates when your change policy permits it; otherwise subscribe to the vendor’s security advisories and schedule prompt maintenance. Update the NAS operating system, file-sharing components, VPN endpoint, router and client operating systems. Run the platform’s security advisor or scanning tools and investigate warnings rather than dismissing them. Keep a tested configuration backup before major updates and confirm that required protocols and permissions still work afterward.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
8. Encrypt management and file-transfer traffic
Force HTTPS/TLS for administration
Redirect or disable plain HTTP for the management interface, install a valid certificate where practical, and verify that remote users see the expected hostname and certificate. Do not train users to click through certificate warnings; an unexpected warning can indicate interception or a misrouted connection.
Protect file-sharing sessions
Enable SMB encryption or signing when the NAS and all required clients support it. Signing helps detect tampering; encryption also provides confidentiality. Older clients may fail or incur performance costs, so test representative operating systems and applications before enforcing a setting globally.
Choose secure transfer protocols
Use SFTP or FTPS for workflows that require a transfer service, with narrowly scoped accounts and directories. Disable anonymous access. TLS protects credentials and traffic in transit, but files remain unencrypted on the NAS unless a separate at-rest mechanism is available.
9. Schedule snapshots with a retention policy
Create snapshots for important shares at a frequency that matches the amount of data you can afford to lose. Retain enough hourly, daily or weekly points to cover your normal recovery window, and define automatic deletion so the snapshot reserve cannot silently fill. QNAP specifically recommends scheduled snapshots and a deletion policy.
Test restoring a representative file and a complete folder. Confirm that users cannot browse or delete snapshots unless their role requires it. Snapshots are local recovery points: ransomware using an administrative account may encrypt files and delete snapshots, and a hardware failure can destroy both the live data and its snapshots.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
10. Keep independent backups
Use more than one copy and location
Maintain at least one copy that is offline, off-site or immutable when available. An offline USB or removable backup should be disconnected when it is not actively backing up; CISA recommends this separation because malware on the NAS or a client cannot continuously alter a disconnected drive. Rotate media or use a backup service with an immutable retention lock.
Protect the backup system itself
Use a dedicated backup account with write access limited to the backup job, not a general administrator credential. Protect the backup console with MFA, patch it, and separate its network from ordinary user devices. Keep encryption keys or recovery passwords in a protected location separate from the NAS.
Test restoration, not just completion
After configuring a backup task, restore files immediately and repeat the test regularly, as Synology’s checklist advises. Test individual files, permissions, a large share and a full-NAS recovery scenario. Record how long each restore takes and whether applications, timestamps and access-control lists survive.
Synology and QNAP implementation notes
On Synology DSM, look for Security settings covering sign-in protection, IP auto-blocking, allow/deny lists and firewall rules. Configure these with the NAS’s current DSM documentation because labels and capabilities vary by model and release.
On QNAP QTS or QuTS hero, use the security controls for router placement guidance, firewalling, account protection, service exposure and scheduled snapshots. QNAP’s available snapshot and immutable features differ by model, filesystem and firmware. Confirm support in the exact product documentation before promising a retention or immutability behavior.
For either platform, export or record the final firewall, account, VPN and backup configuration. A replacement unit may not preserve every setting, and an incident is the worst time to reconstruct them from memory.
Common failure modes and fixes
- Remote access still works without the VPN: inspect router port-forwarding and UPnP mappings, remove public NAS rules, and retest from a cellular connection.
- A user can see more shares than intended: review group membership, inherited ACLs, application permissions and cached credentials on the client.
- Backups are encrypted during an incident: disconnect the backup target when idle, use separate credentials, add immutable retention and verify that the backup console is not reachable from every user VLAN.
- SMB encryption breaks an old device: identify the incompatible client, update or replace it, or isolate it on a restricted network rather than weakening protection for every client.
- Administrators are locked out after a firewall change: use the local console or a trusted management network, restore the last known-good rule set and document a second recovery path.
- Snapshots consume all space: shorten retention, increase reserved capacity, and investigate high-churn folders instead of allowing the NAS to run without free space.
How to choose the next investment
| Situation | First investment | Why |
|---|---|---|
| NAS is reachable from the internet | Remove port exposure, disable UPnP/DMZ and deploy VPN access | Exposure reduction generally delivers the largest immediate risk reduction |
| Users share one administrator password | Named least-privilege accounts, MFA and lockout | Limits account takeover and makes actions attributable |
| Only local snapshots exist | Offline, off-site or immutable backup plus restore testing | Creates recovery independence if the NAS is compromised or fails |
| Traffic crosses an untrusted network | HTTPS/TLS and compatible SMB encryption, signing or SFTP | Protects credentials and content in transit |
| MFA is available but phishable | FIDO2/WebAuthn security key, if the NAS, VPN and identity provider support it | Improves resistance to credential-phishing attacks |
Verification checklist
- NAS connects to a router and is not in a DMZ.
- Router UPnP is disabled and no unnecessary port forwards remain.
- Remote administration requires a VPN and MFA.
- All administrator and remote-access accounts use MFA; stale accounts are removed.
- Firewall rules allow only required source networks and ports.
- Telnet, SSH and unused applications are disabled or restricted.
- Firmware, packages, router and VPN software are patched.
- HTTPS/TLS is enforced; SMB protection or SFTP/FTPS is enabled where compatible.
- Snapshots run on important shares with tested retention.
- An offline, off-site or immutable backup exists, is protected by separate credentials and has a documented, tested restore.
This layered design cannot provide the specific protection of volume encryption. It does, however, close the most common remote-entry paths, make stolen credentials less useful, reduce the blast radius of a compromised account and preserve a recovery route when the NAS or a connected computer is attacked.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
