I have a Synology DS214se, with DSM 6.0 update 3 installed. QuickConnect is disabled and I haven't added any external access permission.

Is my NAS safe from attacks?

I was wondering if I should add some firewall, or other protection to it. I do not have any port forwarding on my router, so I guess that it is denying external requests properly.

  • What kind of attacks are you trying to protect it from? There are no absolutes, especially in security. You really need to identify what you're trying to protect before you can say how safe you are. – heavyd Apr 25 '16 at 18:50
  • @heavyd Mainly ransomware kind of attack. – tomasyany Apr 25 '16 at 19:02
  • 3
    A ransomware attack would typically originate from a computer already inside your network. What access do the machines on your network have to the NAS? Are users required to enter a username/password before accessing/modifying data on the NAS? – heavyd Apr 25 '16 at 19:13
  • @heavyd So far, only two machines (and two users) have access to the NAS. A windows and a mac. The first one can only read a movie library from the windows machine; the second one (my personal mac, using personal user from administrator group) can read/write the movie and photo library only. I don't require to enter password everytime, it is saved in both computers to win time. – tomasyany Apr 25 '16 at 19:40
  • 1
    What has your research effort shown using Google? Questions on SU are expected to show some research effort on your part and should be included in your question. – Moab Apr 25 '16 at 21:20

Expanding on heavyd's comment: a ransomware attack is likely to hit your client computer first (via drive-by download or something similar), and from there it can potentially encrypt anything the client computer has access to, including the NAS. Your first line of protection here is access controls: requiring a password to mount the NAS, and setting permissions so that even after it's mounted you don't have access to anything you don't need. But there's a limit to what this can do, because malware might wait for you to mount the NAS, then use your connection to access & encrypt your files on the NAS. If the malware is running on your computer, then its access is equal to yours.

If you have data you don't want to lose to ransomware, there's one clear best solution: an offline backup. Offline, so the ransomware can't get at it. And since the backup has to be online to be updated, you really need at lest two backups, at least one of which is offline at any time. This is a really good idea in any case; ransomware is just one of the many kinds of data disasters that can happen, and a good backup system will protect against other disasters as well.

| improve this answer | |

If samba share permissions are set to read-only then it is will be harder for ransomware or any PC-attack to hose your files. If you can avoid connecting Windows boxes to your NAS (i.e. mapping to a drive), then that is a better security posture: or unmap them when you are not using the NAS. Not particular convenient, but effective.

| improve this answer | |

It is only as secure as your router, if your router security can be broken then anything on your LAN is also compromised. If there is no port forwarding going on in the router then the NAS is essentially behind a firewall; the router's firewall.

If you're only concerned about remote attacks, I'd consider your setup safe; there's not much else you can do. Maybe check up on upgrading your router's firmware as this can fix security related bugs. But also do your research as messing with firmware is never 100% safe.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.