NAS Security Checklist for Synology and QNAP

A NAS often stores some of the most important files in a home or small business, but many devices are left with weak administrator settings, unnecessary services, direct Internet exposure, and no tested recovery plan.

This checklist is designed as the security hub for the site. It covers the controls I would review first on a Synology or QNAP NAS, then links to the more detailed guides where needed.

1. Secure administrator accounts first

Create a separate administrator account with a unique username and strong password. Avoid using the default administrator account for normal management when the platform allows you to disable it.

For QNAP, the vendor specifically recommends replacing and disabling the default admin account. Also enable 2-step verification for administrator accounts and any user with access to sensitive data.

Review the user list regularly and remove old or unknown accounts.

2. Do not expose the NAS directly to the Internet unless you really need to

Direct port forwarding to the NAS management interface increases the attack surface. If remote administration is required, I prefer a VPN or another secure access layer instead of exposing QTS, DSM, SMB, SSH, or other management services directly.

Also review UPnP on both the NAS and router. Automatic port creation is convenient, but convenience is not a good reason to expose services you do not need.

3. Disable unused services

Every enabled service is another component to maintain and another potential path into the NAS.

Review whether you actually use:

• FTP
• Telnet
• SSH
• WebDAV
• NFS
• AFP
• UPnP discovery
• Bonjour
• Remote database services
• Third-party applications

Do not disable a service only because it sounds unnecessary; first confirm that no users or applications depend on it.

4. Keep DSM, QTS, packages, and applications updated

Security updates are one of the most basic protections, but NAS devices are often ignored once they are installed.

Keep the operating system and installed packages updated. For critical business systems, review release notes and compatibility before major upgrades, but do not leave known security updates pending indefinitely.

Remove applications you no longer use. An unused application is still software that needs patching.

5. Use the built-in security tools

QNAP provides tools such as Security Counselor, QuFirewall, and Malware Remover. Synology provides Security Advisor and firewall features in DSM.

These tools are not a replacement for good configuration, but they are useful for identifying weak settings, suspicious activity, and unnecessary exposure.

On QNAP, see my detailed QNAP NAS security hardening guide for the interface-level steps.

6. Apply firewall and access-control rules carefully

If the NAS only needs to be accessed from known local networks, restrict management and file-service access where practical.

For example, a business NAS might only need management access from an IT VLAN or a known internal subnet.

Be careful when applying allow-only rules remotely. A wrong rule can lock you out of the device, so verify that you have another recovery path before applying restrictive policies.

7. Encrypt sensitive data at rest

Encryption protects stored data if drives or the entire NAS are stolen. The exact options differ between Synology DSM, QNAP QTS, QuTS hero, and NAS models, so check what your platform supports.

Store encryption keys and passwords securely outside the NAS. Encryption is useful only if you can still unlock the data during recovery.

8. Use encrypted connections

Use HTTPS for management and avoid insecure protocols such as Telnet and plain FTP when secure alternatives are available.

For remote file transfer, prefer protocols such as SFTP or a VPN-protected connection rather than sending credentials and data over unencrypted services.

9. Separate normal user access from administration

Users who only need shared folders should not be administrators.

Use groups and folder permissions so people receive only the access required for their work. Avoid giving broad read/write permissions to everyone just because it is faster during setup.

Review guest access and anonymous shares. If a share does not need to be public, do not leave it public.

10. Use snapshots where supported

Snapshots can provide fast rollback after accidental deletion, bad changes, or some ransomware incidents.

They are especially useful when combined with restricted permissions and versioned backups.

But snapshots stored on the same NAS are not enough by themselves. If the entire NAS or storage pool is lost, local snapshots can disappear with it.

11. Maintain an independent backup

Security and backup are connected. Even a well-secured NAS can fail, be stolen, suffer storage corruption, or be affected by a mistake.

Use the NAS Backup Strategy Guide to build local and off-site recovery copies.

For Synology, I have detailed walkthroughs for Google Drive, Amazon S3, and rsync.

For QNAP, see the external-drive backup guide and Amazon S3 guide.

12. Test restoration

A backup job showing “Success” does not prove that you can recover after an incident.

Restore a small folder to another location, open the restored files, and make sure you know where the encryption keys, administrator credentials, and recovery instructions are stored.

For important business data, repeat the restore test on a schedule.

13. Configure notifications

Enable notifications for failed backups, storage warnings, disk errors, suspicious login attempts, and important system events.

A security control that fails silently is much less useful.

14. Review logs after suspicious activity

If you see failed logins, unexpected configuration changes, or unknown access, review system and connection logs before simply changing the password and moving on.

Look for:

• Unknown source IP addresses
• Repeated login failures
• New users or permission changes
• Unexpected application installations
• New port-forwarding or remote-access settings
• Backup or snapshot deletions

15. Protect the network around the NAS

The NAS is only one part of the environment.

Keep the router and firewall updated, use secure Wi-Fi, isolate untrusted IoT devices where practical, and avoid exposing internal services directly.

For home environments, see Secure Your Home Network.

A simple NAS security baseline

For most small environments, I would want at least this baseline:

• Separate administrator account
• Default admin account disabled where practical
• 2-step verification
• Strong unique passwords
• Current firmware and packages
• No unnecessary direct Internet exposure
• Unused services disabled
• Firewall or access controls where appropriate
• Snapshots enabled where supported
• Independent local and off-site backups
• Notifications configured
• Periodic restore tests

Conclusion

NAS security is not one checkbox or one antivirus package. The strongest setup comes from reducing exposure, protecting administrator accounts, keeping the system updated, limiting permissions, and having recovery copies that an attacker or hardware failure cannot easily destroy.

Start with the administrator accounts and Internet exposure first. Those two areas usually give you more security value than installing another application and leaving the basic configuration weak.