A Copy on the NAS Is Not a Backup
6 min read
The NAS is where a small business piles everything. Drawings, quotes, accounting files, ten years of site photographs, all on one appliance in the corner, and in many companies that same appliance is also the backup. Ransomware could not ask for a better arrangement: everything gathered in one place, on the same network as every desktop in the building. This piece is about the settings you choose beforehand rather than what to do afterwards. If it has already happened, the response sequence is in the ransomware article. What follows is how to keep that day away, and how to still have something to restore if it arrives.
1. Why the NAS is the first thing hit
Ransomware usually enters through somebody's desktop. Its first job is to find anything else worth encrypting, and the NAS is generally already mounted on every machine in the office as a writable network drive. It does not have to attack the NAS. It walks the path that was left connected.
To malicious code a network drive and a local folder are the same thing: a writable path. Whatever the logged-in user can reach, it can reach. So one infected desktop takes out every folder that person had rights to, which is not a design flaw but simply how shared drives work.
There is a second thing worth settling early: what is actually on that appliance. In most companies the NAS holds customer lists, orders and staff records, which is personal data in the legal sense. In Taiwan that means the Personal Data Protection Act applies, and most countries have an equivalent regime. An incident is then not only your operational loss, it also involves other people's rights and your duty to tell them.
2. A copy is not a backup
This is the sentence that matters most here. Companies say we have backups, everything syncs to the NAS. That is not a backup, it is a copy kept somewhere else. The difference is not how many copies exist. It is whether that copy goes down with everything else.
The copy syncing to the NAS is on the same network as the source, reachable with the same credentials, and mounted the whole time. When encryption runs, it gets processed too. You find out when the original and the thing you called a backup stop opening at the same moment, which is the most common and most disorienting version of this event.
3. Whether to expose it to the internet
This is the biggest fork in NAS security. Every vendor ships a feature for reaching the device from outside, it takes a few clicks in the settings, and so a lot of companies switched it on during the first week and never thought about it again.
Once it is exposed, the appliance stops being a box in the corner of the office and becomes a service on the internet. Automated programs sweep the whole address space daily looking for exactly this, and on finding one they try default accounts, leaked passwords and known vulnerabilities. They do not care who you are or how small the company is.
| What you want | Cost of exposing it directly | Safer route |
|---|---|---|
| Reach company files while travelling | The whole appliance and everything on it faces the internet | Come in over the company VPN, then open files as usual |
| Send a client a large file | A one-off transfer leaves a permanent public entrance | Use a cloud drive link and revoke access once it has landed |
| Back up personal photos from home | Personal convenience exposes the company data alongside it | Keep personal use on separate storage rather than sharing the appliance |
| Administer the NAS remotely | The management interface is the highest-risk thing to publish | Administer from the internal network, over VPN when genuinely remote |
The middle column is not scaremongering. Appliances with a published management interface see login attempts in the thousands per day, none of which requires a human. It is also why changing the default port helps only a little: it cuts some of the noise and does not stop scanning aimed at this class of device. Not publishing it is what works.
4. The defaults to change on day one
NAS defaults exist to get people running quickly, not to keep them safe. The following belong to the first day, all of them reachable from the settings screens and none requiring a technical background.
Five defaults worth changing immediately
- Disable the built-in administrator account. Create your own admin account first, then switch the shipped one off, because its name is known to everybody and hands over half the answer.
- Keep the admin account separate from the one you work in. Open files with an ordinary account so that a leaked everyday credential cannot change settings or turn protections off.
- Turn on two-factor authentication. For admin accounts at minimum, for everyone if you can. It is the barrier still standing after a password leaks.
- Turn on automatic blocking. Repeated failed logins from one source get shut out for a while. This one stops the overwhelming majority of automated attempts and costs a single checkbox.
- Switch off services you do not use. Photo, media, download and web server add-ons that nobody opened are worth disabling. Every running service is a possible way in.
Updates matter just as much. NAS operating systems have vulnerabilities and vendors fix them: Synology's product security advisory page publishes each fix along with the versions affected, and the other manufacturers keep comparable pages. Turn on automatic updates, or at minimum look at that page monthly. It takes less time than people expect.
5. Snapshots: least effort, widest coverage
A snapshot records the state of the files at a point in time. It does not copy the data again, so it occupies far less space than a full duplicate and can be kept frequently, hourly for several days for instance. Most business NAS models include the feature. Most companies have never enabled it.
Against ransomware the value is that snapshots are not reachable through ordinary file access. After an encryption event you can roll an entire shared folder back to how it looked a few hours earlier. That turns the cost from rebuilding months of work into losing a few hours of it, a gap wide enough to justify enabling it this afternoon.
Snapshots are still not a substitute for backup, and that needs saying plainly. They live on the same appliance as the data, so a failed unit, a theft or a flood takes them with it. They defend against files being ruined. They do not defend against the machine being gone. Both happen, so both need covering.
6. What real offline backup looks like
The 3-2-1 rule says keep three copies, on two kinds of media, with one of them off site. It sounds like something only large organisations manage. There is a cheap version that a small business can actually run.
The first copy is the NAS itself, the one everybody works from. The second is an external drive that gets unplugged and put away when the backup finishes, rotated weekly or monthly. The third goes to cloud storage, under credentials that never appear on an office computer, because otherwise a stolen account takes the cloud copy along with everything else.
Unplugging is the substance of it, not a formality. A drive left permanently attached to the NAS is simply another writable device and gets encrypted with the rest. The same applies to a folder syncing to the cloud under the same account: it has the NAS problem, unless the service keeps version history and you know how to use it.
Then verification. A backup that has never been restored differs from no backup only in ways you discover on the day it matters. Once a quarter, pick a few files, restore them for real, and open them. Ten minutes covers it, and afterwards you can honestly say the company has backups rather than an appliance full of files.
A NAS concentrates your data, concentration is efficient, and it also means one bad day reaches everything at once. The sentence to keep is the one in the middle: a copy sitting on the same network as its source is not a backup. Three things are worth doing today. Confirm the management interface is not published to the internet, enable snapshots and protect them, and set aside an external drive that gets unplugged after every backup. Together they take less than an afternoon, and they decide whether that day costs you a few hours or a decade.
Common questions
- Can a NAS be our backup?
- It can be the first copy, not the only one. Data synced to a NAS sits on the same network as its source and is reachable with the same credentials, so ransomware encrypts both and the original and the backup stop opening together. The test is whether a compromised desktop can write to that data right now. If it can, it is a copy. A real backup is disconnected, such as an external drive that gets unplugged and put away.
- Does the NAS need to be reachable from the internet? How do we work remotely?
- Most small businesses do not need it. Exposing it turns the appliance into an internet service that gets login attempts around the clock, and publishing the management interface is the riskiest form of it. To reach files from outside, coming in over a company VPN and then opening them normally is far safer. If the need is simply sending a client a large file, use a cloud drive link and revoke it once the file has landed.
- If the NAS is hit by ransomware, will snapshots save it?
- Possibly, provided they were enabled beforehand and protected. Snapshots are not reachable through ordinary file access, so they frequently survive, and a shared folder can be rolled back to its state before the encryption. Newer ransomware looks for snapshots first, which is why the immutability setting needs turning on as well. Snapshots also live on the same appliance, so a failed or stolen unit takes them with it. Offline backup is still required.