Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If your NAS cannot encrypt its storage volume, protect it with layered controls rather than treating the missing feature as a single point of failure. Put the NAS behind a router, disable UPnP and DMZ exposure, require a VPN for remote access, enforce strong multi-factor authentication, restrict firewall and share permissions, turn off unnecessary services, patch the system, encrypt network traffic, and maintain snapshots plus independent offline or off-site backups. These measures reduce intrusion and recovery risk, but they do not encrypt data at rest on the disks.
The exact menu names and available protocols differ between NAS models and DSM, QTS, or QuTS hero releases. Use the labels in your firmware, and verify that every client, VPN endpoint, and identity service supports the security setting before enforcing it.
What the missing volume encryption changes
Volume encryption protects data at rest: someone who removes a disk or obtains an offline copy of the storage may not be able to read it without the encryption key. If your NAS lacks that capability, assume that a powered-down disk, a stolen chassis, or a compromised storage device could expose readable files. The controls below address different moments in the attack chain.
- Exposure controls keep attackers from reaching management interfaces and file services.
- Identity controls make stolen passwords less useful.
- Permission controls limit what an account or application can change.
- Transport controls protect credentials and files while they cross a network.
- Recovery controls let you restore clean data after ransomware, deletion, or hardware loss.
HTTPS/TLS, SFTP, FTPS, and SMB encryption or signing protect data in transit. They do not provide the at-rest protection that volume encryption would have provided, so physical access and backup handling still require separate controls.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
1. Put the NAS behind a router and remove accidental exposure
Use the router as the internet boundary
Connect the NAS to your router or managed network switch, not directly to an ISP modem. The router should be the device that receives the public address and applies inbound filtering. A NAS connected directly to the modem can become reachable before its own firewall and account protections are correctly configured.
Disable UPnP and DMZ features
Turn off UPnP on the router so the NAS or an application cannot automatically create port-forwarding rules. Do not place the NAS in the router’s DMZ or use a “one-click” remote-access feature that publishes multiple services. Review existing port-forwarding entries and remove rules you no longer need; a forgotten rule can keep an administration page public months after a test.
Segment trusted and untrusted devices
Where the router or firewall supports VLANs or separate networks, place the NAS on a server or storage segment. Permit only the client subnets that need file access. Guest Wi-Fi, smart-home devices, and internet-facing services should not have unrestricted routes to the storage network. Use restrictive access-control lists (ACLs) and firewall rules, then add narrowly scoped exceptions for backup servers, management workstations, or application hosts.
2. Use a VPN instead of publishing NAS administration ports
Remote users should first connect to a VPN with modern cryptography and then reach the NAS through its private address. Do not expose DSM, QTS, QuTS hero, SSH, SMB, or other administration and file-service ports directly to the internet merely to make remote access convenient. A VPN concentrates authentication, logging, and revocation in one place and avoids maintaining many public port-forwarding rules.
Require MFA on the VPN account as well as on NAS administrator accounts when the platform permits it. Limit VPN routes to the subnets and ports a user actually needs; a full tunnel is not automatically safer if it grants every remote device broad access to internal systems. Remove former staff and contractors from the VPN group promptly, and review connection logs for unfamiliar locations, devices, or repeated failures.
When selecting a VPN method, check compatibility with the NAS model, router, mobile clients, and security-key or WebAuthn support. A technically strong protocol that cannot be patched or supported on your equipment is a poor operational choice.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Harden administrator and remote-access authentication
Require multi-factor authentication
Enable MFA for every administrator and every account that can connect remotely. CISA recommends combining a password or other credential with a phishing-resistant second factor such as hardware-based PKI or FIDO authentication. FIDO2 security keys are a practical option when the NAS interface, its identity provider, and the VPN all support WebAuthn or security-key login; support is implementation-dependent, so verify it before purchasing or enforcing keys.
Recommended Free Tools
Separate named accounts
Give each administrator a separate named account instead of sharing a built-in “admin” login. Use a non-administrator account for routine file work and elevate only when a configuration change is required. Record which person owns each privileged account so an audit can distinguish a legitimate change from a stolen credential.
Configure lockout and recovery carefully
Enable automatic blocking after repeated failed logins and set a duration that stops password-guessing without creating an easy denial-of-service against your own staff. Keep a documented recovery route: a second, protected administrator account, a trusted management network, and a tested procedure for clearing a false block. Store recovery codes offline and restrict who can access them.
4. Turn off services you do not use
Disable Telnet and SSH unless a documented operational task requires them. If shell access is necessary, restrict it to trusted administrator IP ranges or the VPN, use key-based authentication where supported, disable password login when practical, and monitor its logs. Never leave a legacy service enabled “temporarily” without an owner and an expiration date.
Apply the same rule to obsolete file-transfer protocols, demo applications, unused web portals, and vendor remote-support agents. Every enabled listener adds code that must be patched and a credential path that must be protected. Before disabling a service, inventory scheduled jobs and applications that depend on it so a security change does not silently break backups.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →5. Build restrictive firewall and allow-list rules
Start with a deny-by-default policy for inbound traffic to the NAS. Add allow rules for trusted source IP ranges and the specific ports needed by administration, file sharing, monitoring, and backup systems. Synology firewall controls can filter by source address, address range, port, and location; equivalent QNAP and QuTS hero controls vary by release. Prefer fixed management subnets or VPN address pools over “any source” rules.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Place rules in an order that evaluates the specific allows before the final deny, and test from both an approved workstation and an unapproved network. Log denied attempts long enough to identify misconfiguration and scanning, but rotate logs so they cannot consume the volume. Firewall rules reduce reachability; they do not replace MFA or per-share permissions for an allowed user.
6. Apply least privilege to users, shares, and applications
Create groups based on job function and grant each group only the folders and applications it needs. Separate read-only media libraries from writable project shares, and avoid giving ordinary users administrative rights “for convenience.” Review per-folder and per-application permissions together: an account that cannot browse a share may still have access through a synchronization, backup, or container application.
Remove stale accounts, disable dormant ones, and review membership after role changes. Use a scheduled access review at least quarterly and after any incident. Keep service accounts separate from human accounts, assign only the required API or share permissions, and rotate their credentials when an employee or vendor with access leaves.
Free tools Windows power users keep installed
One-click scans. No signup required.
Remember that permissions cannot stop a compromised client that already has write access. Malware running on an authorized workstation can encrypt or delete every file that workstation is allowed to change, which is why snapshots and independent backups are essential.
7. Patch firmware, packages, and security components
Enable automatic firmware and package updates when your change-control process can tolerate them; otherwise subscribe to vendor security advisories and apply updates on a defined schedule. Test critical applications after an update, but do not defer security fixes indefinitely because an optional package might need adjustment.
Run the NAS’s built-in security adviser, malware scanner, and configuration checks where available. Investigate warnings about exposed services, weak ciphers, old packages, or administrator accounts rather than dismissing them. Keep an inventory of the NAS model, firmware branch, installed applications, and backup software so you can determine quickly whether an advisory affects your system.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
8. Encrypt management and file-transfer traffic
Management interfaces
Force HTTPS/TLS for the NAS administration interface and replace default or self-signed certificates when your environment can support a trusted certificate. Redirect or disable plain HTTP, and verify that browsers and management tools no longer send credentials over an unencrypted connection.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFile protocols
Enable SMB encryption or signing when supported by both the NAS and clients. Signing helps detect tampering and, depending on the configuration, does not provide confidentiality; SMB encryption provides confidentiality but can require more CPU and may reduce compatibility with older clients. Test with every operating-system version and application that accesses the share before enforcing a strict mode.
For suitable transfer workflows, use SFTP or FTPS instead of legacy unencrypted FTP. These protect credentials and files while moving between systems, but they still write unencrypted data to the NAS volume unless the platform offers separate at-rest encryption.
9. Use snapshots as rapid recovery points
Schedule snapshots for important shares and define a retention policy that balances recovery history against available storage. Keep enough frequent points to cover the period in which ransomware or accidental deletion might go unnoticed, and protect snapshot administration with the same MFA and least-privilege controls as ordinary shares.
A snapshot is local to the NAS. Ransomware that gains sufficient administrative access may delete snapshots, and a disk failure can destroy them with the primary data. Treat snapshots as a fast rollback mechanism, not as a backup. Periodically perform a test restore of individual files and a complete share so you know the retention policy and recovery process work in practice.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →10. Maintain independent, offline, and off-site backups
Keep at least one copy outside the NAS’s immediate control. An offline disk, removable medium, or disconnected backup target prevents a compromised NAS from rewriting every copy at once; disconnect an external drive when it is not actively backing up. An off-site copy protects against theft, fire, flood, and a site-wide compromise. Immutable or write-once retention adds protection when the backup platform supports it.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Use a backup account with narrowly scoped permissions and a separate administrative boundary where possible. Encrypt the backup itself if the destination supports it, because the NAS volume’s lack of encryption does not justify leaving backup media readable. Test restoration immediately after configuring a task and repeat tests regularly, recording how long a restore takes and which applications require additional steps.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.11. A practical rollout sequence
- Map dependencies: list shares, applications, clients, backup jobs, management workstations, and remote users before changing services or ports.
- Close the perimeter: place the NAS behind the router, remove UPnP-created forwards, take it out of DMZ mode, and create the storage-network segment.
- Replace direct remote access: configure the VPN, MFA, limited routes, and logging; verify access from a mobile or external connection before removing public forwards.
- Protect identities: create named administrator accounts, enable MFA, set lockout and allow-list rules, and disable dormant accounts.
- Reduce listeners: turn off Telnet, unnecessary SSH, legacy transfer protocols, and unused applications; document any exception.
- Apply permissions: rebuild share and application access around groups and least privilege, then test a normal user, a read-only user, and an administrator.
- Patch and scan: update firmware and packages, run the platform’s security checks, and resolve high-severity findings.
- Protect traffic: enforce HTTPS/TLS, configure SMB signing or encryption where compatible, and move appropriate transfers to SFTP or FTPS.
- Prove recovery: enable scheduled snapshots, configure independent offline or off-site backups, and perform a documented restore test.
How the choices compare
| Control choice | Primary benefit | Account-takeover resistance | Recovery independence | Compatibility and effort |
|---|---|---|---|---|
| VPN plus segmentation and firewall allow-lists | Greatly reduces internet exposure and limits lateral movement | Depends on VPN authentication and MFA | None by itself | Requires router or firewall design and client configuration |
| MFA with a FIDO2 or other phishing-resistant factor | Blocks many password-reuse and phishing attempts | High when NAS, identity provider, and VPN all support it | None by itself | Implementation-dependent; provide spare keys and recovery procedures |
| Snapshots | Fast rollback from deletion or ransomware | Does not prevent takeover | Low; snapshots remain on the NAS | Storage consumption and retention planning are required |
| Offline, off-site, or immutable backup | Preserves a copy outside a compromised NAS | Does not stop intrusion | High, depending on isolation and restore testing | Requires additional media, storage, or operational procedures |
| HTTPS/TLS, SMB encryption or signing, SFTP/FTPS | Protects credentials and files in transit | Does not replace MFA | None by itself | Older clients may lack support; encryption can add CPU overhead |
Common failure modes and fixes
“The NAS is not internet-facing, so it is safe.”
A compromised laptop, flat home network, or overly broad VLAN rule can still reach it. Verify reachability from every client segment and enforce source-based firewall rules rather than relying on the absence of a public address.
“Snapshots are our backup.”
They are not independent. Keep a disconnected or off-site copy and verify that a restore works before an incident.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“MFA is enabled, so permissions no longer matter.”
MFA protects login events, not files an authorized account can already modify. Reduce share rights and isolate service accounts so one stolen session cannot rewrite the entire volume.
“Turning on every encryption option is always best.”
SMB signing, SMB encryption, and strict TLS settings can break old clients or increase CPU use. Test each client, remove obsolete systems, and enforce the strongest setting that your supported fleet can handle.
“A lockout policy solved the attack.”
Lockouts slow guessing but can be abused to block legitimate users. Combine them with allow-lists, VPN-only administration, MFA, alerting, and a documented recovery account.
Platform-specific checks
On Synology systems, review the DSM security areas for firewall rules, IP auto-blocking, allow/deny lists, account protection, certificates, and package updates. On QNAP systems running QTS or QuTS hero, review the corresponding security, network, access-control, and snapshot settings. Menu names, supported protocols, and immutable-snapshot behavior vary by model and firmware release, so confirm the setting in the current administrator guide and test it with your actual clients.
For either platform, record the final configuration: approved source networks, exposed ports, enabled services, privileged accounts, MFA enrollment, snapshot retention, backup destinations, and the date of the last restore test. That record turns a collection of toggles into an auditable security baseline.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
