Synology Security Essentials

Why NAS Security Matters

A NAS - Network Attached Storage - is a storage box that lives on your home network and holds files you can reach from any device. That convenience is exactly why it is worth protecting: everything is in one place.

Think about what is on yours. Family photos going back years. Tax documents. Maybe backups of your computer or your phone. If a stranger got in, they could copy it, delete it, or lock it away from you. That is not a comfortable thought, but it is why we take a few minutes to lock the doors.

Retire the Default Admin Account

Every Synology starts with a built-in account often called admin. The trouble is that attackers know this name too, so it is the first one they try. We are going to stop using it.

Now the obvious target name no longer works at all. An attacker has to guess both a username they do not know and a password, which is a much taller order.

• Create a new user account with your own name and give it administrator rights.
• Sign out, then sign back in with that new account to make sure it works.
• In Control Panel, under User and Group, disable the built-in admin account.
• Also disable the built-in guest account if it is not already off.

Strong, Unique Passwords

A password is the lock on your front door. A weak one is like leaving the key under the mat. The two rules that matter most are: make it long, and never reuse it.

Why unique? Because when a website you use gets hacked, thieves take those passwords and try them everywhere else. If your NAS password is the same one, they are already inside. A different password for the NAS breaks that chain.

• Long beats fancy. A phrase of four or five random words is stronger and easier to remember than a short jumble of symbols.
• Unique. The password for your NAS must not be the same one you use for email or shopping.
• Written down safely. A notebook in a drawer, or a password manager app, is fine. Your memory alone is not.

Turn On Two-Factor Sign-In (2FA)

Two-factor authentication, or 2FA, adds a second lock. After your password, DSM also asks for a short code from your phone. So even if someone learns your password, they still cannot get in without your phone in hand.

Yes, it is one extra step each time. It is also the single most effective thing you can do to keep strangers out. For an account that guards your whole digital life, that trade is well worth it.

• You install an authenticator app on your phone, such as Synology Secure SignIn or another authenticator app.
• In your DSM personal settings, you turn on 2-factor authentication and link the app by scanning a code.
• From then on, signing in asks for your password plus the changing 6-digit code from the app.

Run Security Advisor

Security Advisor is a free tool built into DSM. Think of it as a checkup: it scans your NAS, points out weak settings, and tells you in plain terms what to fix. You do not have to know what to look for - it looks for you.

Common things it flags: weak passwords, the admin account still turned on, 2FA not enabled, or updates waiting to be installed. Notice that these are the very things earlier in this guide. Security Advisor is your report card.

• Open the Security Advisor package from the main menu.
• Run a scan and let it finish - it takes a few minutes.
• Read the results. Items are grouped by how serious they are.
• Work through the flagged items, starting with the most serious.

The Built-In Firewall

A firewall is a gatekeeper. It decides which kinds of network traffic are allowed to reach your NAS and blocks the rest. DSM has one built in - it is just turned off by default.

The simple idea behind a firewall is allow only what you need. By default, once you turn the firewall on, you set it to block everything and then open small doors only for the services you actually use, like DSM itself on your home network.

• Turn the firewall on in Control Panel, under Security.
• Allow access from your own home network so you do not lock yourself out.
• Leave everything else blocked unless you have a clear reason to open it.

Auto Block: Lock Out Bad Logins

Attackers often try to break in by guessing passwords over and over, thousands of times. Auto Block watches for that. After too many failed sign-ins from one place, it slams the door on that address.

This quietly defeats the most common kind of attack. A machine trying to guess your password gets a few tries and then is shut out entirely. You never see it happen, but it is working in the background every day.

• In Control Panel, under Security, find Auto Block and turn it on.
• Set how many failed tries are allowed before a block - a handful within a few minutes is reasonable.
• Choose how long the block lasts, or make it permanent.

Account Protection

Auto Block works on network addresses. Account Protection is its cousin that works on accounts. It watches for repeated failed sign-ins to a specific user and temporarily protects that account from being hammered.

The two features work as a team. Auto Block shuts out a bad address entirely, while Account Protection guards an individual login even if the attempts come from many different addresses. Turning both on gives you cover from two angles.

• In Control Panel, under Security, find Account Protection and enable it.
• Leave the default thresholds unless you have a reason to change them - they are sensible.
• This is a set-and-forget feature; once on, you do not need to touch it.

HTTPS and Certificates, In Brief

When you connect to your NAS, the connection can be plain or encrypted. Encrypted means scrambled so no one in between can read it. That encrypted version is called HTTPS, and it is the one you want.

DSM can set up HTTPS for you, and it can get a free certificate automatically. You do not need to understand the math behind it. You just want to see that your connection to the NAS is the locked, HTTPS kind - most browsers show a small padlock.

• HTTP is the plain, unlocked version. Avoid it.
• HTTPS is the locked, scrambled version. Use it.
• A certificate is the digital ID card that makes HTTPS possible.

Keep DSM and Packages Updated

DSM is the software that runs your NAS, and the add-ons you install are called packages. Updates to both often fix security holes. An out-of-date NAS is one of the easiest to break into, so staying current matters a lot.

Automatic updates mean you do not have to remember. The NAS quietly patches itself, usually in the middle of the night, and you wake up safer. This is one of the highest-value settings for the least effort.

• In Control Panel, under Update and Restore, turn on automatic installation of DSM updates.
• Set it to install important security updates on a schedule, such as overnight.
• In Package Center, turn on automatic updates for your installed packages too.

Snapshots: Your Ransomware Undo Button

A snapshot is a saved picture of your files at a moment in time. If ransomware scrambles your files, you can roll back to a snapshot taken before the damage - like an undo button for your whole NAS.

To use them, install the Snapshot Replication package and turn on snapshots for the shared folders that hold your important files. Set a schedule, keep a good number of them, and you have a strong safety net.

• Snapshots take up very little space and can be made every hour if you want.
• You can keep many of them going back days or weeks.
• Restoring is fast because the older versions were never truly gone.

Turn Off Services You Do Not Use

Every service running on your NAS is another door. Some you need; many you will never touch. The tidy rule is: if you do not use it, turn it off. Fewer doors means fewer ways in.

Go through Package Center and your file services with a simple question for each: do I actually use this? If the answer is no, disable it. You can always turn it back on later if you find you need it.

• File sharing protocols you do not use, such as FTP or NFS if you never set them up.
• Packages you installed to try once and forgot about.
• Any web or media service you are not actively using.

Turn Off the Old, Insecure SMB1

SMB is the language your NAS uses to share files with Windows and Mac computers. There is an old version called SMB1 that is known to be unsafe. Modern devices use newer, safer versions instead.

SMB1 dates back decades and has well-known security holes - it was at the heart of some famous ransomware outbreaks. Unless you have a very old device that truly needs it, there is no reason to leave it on.

• In Control Panel, under File Services, open the SMB settings.
• Set the minimum SMB version to SMB2 or higher.
• Save, then check that your computers can still reach the NAS - modern ones will.

Secure Remote Access

It is handy to reach your files when you are away from home. The wrong way to do that is to open your NAS straight to the internet. The right way is to use a safe path that does not leave your front door wide open.

QuickConnect is the easy choice for most homes. A VPN is a step up in both safety and control, and it is my preference for small businesses. Either is far safer than opening ports on your router.

• QuickConnect - Synology's own service that lets you reach your NAS by name without exposing it directly.
• A VPN - a private, encrypted tunnel into your home network, so it is as if you were sitting at home.
• Avoid port forwarding - the old method of poking a hole in your router straight to the NAS.

Give Each Person Only What They Need

If more than one person uses the NAS, give each one their own account with access only to the folders they actually need. This is called least privilege, and it limits the damage if any one account is ever compromised.

The point is not distrust. It is that a limited account can only reach a little, so a mistake or a break-in through that account stays small. Administrator power should belong to as few accounts as possible.

• Everyday users do not need administrator rights - give those sparingly.
• Grant folder access per person: the family photos folder for family, the business folder for business.
• When someone no longer needs access, remove it promptly.

Turn On Login Notifications

Your NAS can tell you when something important happens - including when someone signs in. Getting a message about a sign-in you did not make is an early warning that something is wrong.

Most of the time these messages just confirm your own comings and goings. But the one time you get an alert for a sign-in at 3 a.m. that was not you, you will be very glad you turned this on. It buys you time to react.

• In Control Panel, under Notification, turn on alerts by email or through the mobile app.
• Enable notices for sign-ins and for important security events.
• Make sure the email address on file is one you actually check.

A Monthly Security Checklist

Security is not one and done, but it also does not need much upkeep. A few minutes once a month keeps everything in good shape. Put it on the calendar, perhaps the first of the month.

That is the whole routine. Six quick checks, once a month. Do them with a cup of coffee and you will always know your NAS is in good health.

• Run Security Advisor and clear any new warnings.
• Confirm DSM and your packages are up to date.
• Glance at the recent sign-in history for anything you do not recognize.
• Check that your snapshots and backups actually ran.
• Review who has accounts and remove any you no longer need.
• Make sure your 2FA backup codes are still where you can find them.

If You Think You Have Been Breached

If you suspect someone got into your NAS - strange sign-ins, files you did not change, a ransom message - do not panic, and do not pay anyone. Take these steps in order, and call for help.

Then get help before you try to fix it or wipe it. Acting too fast can destroy the very backups or clues you need. A calm, careful recovery almost always beats a rushed one.

• Disconnect the NAS from the internet - unplug the network cable to stop further damage.
• Do not delete anything yet; you may need it to understand what happened.
• Change your passwords from a different, clean device - not the possibly infected one.
• Check your snapshots and backups to see what clean copies you have.
• Write down what you noticed and when, while it is fresh.

What's in the 27-page PDF

• Why a NAS is worth protecting, and what ransomware is
• Locking down the main admin account and passwords
• Turning on two-factor sign-in and Security Advisor
• The firewall, auto-block, and account protection
• Keeping DSM updated and using snapshots as a safety net
• Safe remote access, and what to do if something goes wrong

Why I wrote this

I write these as printable handouts because a guide you can keep in a drawer beats a web page you have to find again. No jargon, no judgment, no rushing. If you'd rather have someone sit beside you and go through it together, that's a flat $99 first visit with the 30-day follow-up included — serving Portage County from Atwater, Ohio. — Bill