--- description: NAS systems are under attack by baddies looking to ransom your data. Don't be a chump, use these four easy steps for a secure NAS. title: Get a Secure NAS in 4 Easy Steps image: https://www.storagereview.com/wp-content/uploads/2021/04/SecureNAS-Steps.png --- [![Storage Review]()](https://storagereview.com/) --- [Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) [Facebook](https://www.facebook.com/@storagereview) [X (Twitter)](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS Feed](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) [![StorageReview.com](https://www.storagereview.com/wp-content/uploads/2026/07/Storage-Review-2x.png)](https://www.storagereview.com) ≡ Menu - [Home](https://www.storagereview.com/) - [Storage Reviews](https://www.storagereview.com/review) - [End User Reviews](https://www.storagereview.com/consumer) - [Enterprise Reviews](https://www.storagereview.com/enterprise) - [Ubiquiti Reviews](https://www.storagereview.com/best/ubiquiti-reviews) - [SR Merch](https://store.storagereview.com) - [Leaderboards](https://www.storagereview.com/best) - [Best Storage Arrays](https://www.storagereview.com/best/storage-arrays) - [Best Enterprise SSDs](https://www.storagereview.com/best/enterprise-ssds) - [Best Servers](https://www.storagereview.com/best/servers) - [Best Enterprise GPUs](https://www.storagereview.com/best/enterprise-gpus) - [Best Desktops for Local AI](https://www.storagereview.com/best/desktops-local-ai) - [Best Laptops for Local AI](https://www.storagereview.com/best/laptops-local-ai) - [Best Local LLM Tools](https://www.storagereview.com/best/local-llm-tools) - [Agentic AI Hardware](https://www.storagereview.com/best/agentic-ai-hardware) - [Best SSDs & Hard Drives](https://www.storagereview.com/best_drives) - [Best Portable SSDs](https://www.storagereview.com/best/portable-ssds) - [Best Business Laptops](https://www.storagereview.com/best/business-laptops) - [Best Mobile Workstations](https://www.storagereview.com/best/mobile-workstations) - [Best Desktop Workstations](https://www.storagereview.com/best/desktop-workstations) - [Best Mini PCs](https://www.storagereview.com/best/mini-pcs) - [Best Laptop Battery Life](https://www.storagereview.com/best/laptop-battery-life) - [Storage Reference Guide](https://www.storagereview.com/storage-reference-guide) - [About SR](https://www.storagereview.com/about-storagereview) - [StorageReview.com Sweepstakes Rules and Regulations](https://www.storagereview.com/storagereview-com-sweepstakes-rules-and-regulations) Search [Home](https://www.storagereview.com/) » [Review](https://www.storagereview.com/review) » Get a Secure NAS in 4 Easy Steps # Get a Secure NAS in 4 Easy Steps by Adam Armstrong on April 26, 2021 [Data Protection](https://www.storagereview.com/enterprise/data-protection)  ◇  [Enterprise](https://www.storagereview.com/enterprise) In the last few months, it would seem that the evildoers that leverage ransomware to make money have turned their focus to NAS devices. The most recent example we saw was with [QNAP and the Qlocker attack.](https://www.storagereview.com/review/qnap-qlocker-ransomware-update-fix) Though [TerraMaster recently had a security fault come to light](https://www.storagereview.com/news/terramaster-nas-vulnerability-found-over-upnp) and [Synology was suffering attacks a few years back](https://www.storagereview.com/news/synology-urges-user-action-against-potential-ransomware-attacks). Most likely, when the first attacks are successful, attackers are just going to keep it up. Luckily, there are steps users can take to mitigate these attacks, netting a more secure NAS. ## **Why Attack NAS Devices?** So, the question is, why are NAS devices under attack as of late? Well, these devices, particularly Synology and QNAP, are all about simplicity. Someone with little to no IT experience can set up a NAS and start using it with essentially no training. While this makes it nice for home users and small businesses with no IT resources, it also leaves lots of gaps in security. Ultimately it is a tradeoff. The easy setup comes at the cost of potential security issues. Also, NAS platforms are more or less self-hosted clouds these days, staying connected 24/7 leaves them open for an attack (if you aren’t online, you can’t be hacked remotely). W ## **Let’s Backup For a Minute**** ** One of the most important steps users can take is to back up their data. Most NAS offer some sort of backup to offsite. Full backups can be resource-heavy but can be done when system access is low. Storing backups to the cloud is usually not as expensive as retrieving the data, but it is better to pay one of the public clouds for retrieving your data than paying a ransom. Both Synology and QNAP offer [snapshots](https://www.storagereview.com/review/how_to_synology_snapshot_replication) as well or you can leverage something like [Veeam for NAS backup](https://www.storagereview.com/review/veeam-nas-backup-and-recovery-hands-on). Restoring from an air-gapped external backup is the easiest way to fix ransomware issues, but that doesn’t solve the attack vector behind the offense in the first place. ## **Secure NAS Step 1: Disable Console Access** As we said, most modern NAS are tiny little clouds. This is good for ease of use, but bad for security. The first step we need to take is buttoning them up to move toward a more secure NAS. This is done by disabling telnet and SSH so there is no longer console access. For a QNAP you would go to Control Panel>Security>IP Access Protection. Power users love console access, it is a big door open that doesn’t need to be if not in use. ![secure nas synology - disable remote]() For a Synology, you would go to Control Panel>Terminal&SNMP>Terminal. Here, you can disable SSH and telnet. ![secure nas qnap - disable console access]() ## **Secure NAS Step 2: Turn on Auto Block** People would be surprised to learn how often NAS devices are “hacked” by someone just guessing the username and password. Most access these days are just bot-farms guessing passwords over and over in brute force attacks. An easy way to prevent this, and to move one step closer to a secure NAS, is by turning on auto block. Auto block will block an IP address with too many failed login attempts. Users can set up how many attempts they want to allow (keep in mind you may enter the wrong username and/or password yourself). A way we like to deploy Synology in the wild is two failed login attempts over 5000 minutes and you are banned forever. The only fix is logging in locally to the NAS and removing that IP from the blacklist. For Synology, you would just go to Control Panel>Security>Account. Auto Block should be right at the top. Enable it and then put in the attempts you want to allow within a time frame to trigger a block. **![secure nas qnap - synology auto block]()** With QNAP one needs to go to Control Panel>Security>IP Access Protection and set up the attempts there. ![secure nas qnap - qnap auto block]() ## **Secure NAS Step 3: Disable Remove Unused Apps** About a decade ago, there was a marketing campaign telling us that there was an app for everything (or rather someone would say something followed by, there’s an app for that). Now there is and there are tons of apps clogging up our phones, tablets, and now our NAS devices. Lots of this stuff is free and cool and if we just had an extra 30 minutes a day, we would do something with it. But we don’t. Unused apps (some of dubious quality and vetting) on your NAS should be removed or disabled to prevent any security threats. With Synology, you simply need to go to the Package center, click on the app, and there is a drop-down next to the Open where you can choose Stop or Uninstall. **![synology remove apps]()** For QNAP go to the App Center and open the drop-down menu next to the app you wish to stop or remove. ![qnap remove apps]() ## **Bonus: Don’t Use Admin as a Username** This one seems easy, but very few people do it at home or even in the data center. When you set up either a NAS it creates a default account, usually with “Admin” as the username. Most people leave that and just change the password. It’s a nice feeling, thinking I am *The Admin*. But this just takes some of the work away from nefarious actors and is the easiest of all when it comes to making a secure NAS. One solution is to create a new user with your credentials and then delete or disable the original admin account. Or sometimes you can rename the Admin account to something else. Either way, by removing username from the equation hackers have to work much harder to guess both the username AND password. ## **Closing Thoughts** Ransomware attacks against NAS systems are on the rise but you can take steps to protect yourself by deploying a more secure NAS. The above won’t guarantee you will be safe from a ransomware attack, but they will surely help a lot. **Engage with StorageReview** [Newsletter](https://www.storagereview.com/storage_newsletter) |  [YouTube](https://www.youtube.com/user/StorageReview "Opens in a new window") | Podcast  [iTunes](https://podcasts.apple.com/gb/podcast/storagereview-com-storage-reviews/id1060681115 "Opens in a new window")/ [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0 "Opens in a new window") |  [Instagram](https://www.instagram.com/storagereview/ "Opens in a new window") |  [Twitter](https://twitter.com/storagereview "Opens in a new window") |  [TikTok](https://www.tiktok.com/@storagereview? "Opens in a new window") |  [RSS Feed](https://www.storagereview.com/rss.xml) ![]() ### Adam Armstrong Adam is the chief news editor for StorageReview.com, managing our internal and freelance content teams. Previous post: [LucidLink Filespaces: How it Works](https://www.storagereview.com/review/lucidlink-filespaces-how-it-works) Next post: [$800 TrueNAS Build Competition](https://www.storagereview.com/review/800-truenas-build-competition) Trusted Vendors Products and solutions from our affiliate partners: - [ ![Ubiquiti Logo](https://www.storagereview.com/wp-content/uploads/2024/11/2-1.webp) Ubiquiti ](https://store.ui.com/us/en?a_aid=StorageReview "Opens in a new window") - [ ![Newegg Logo](https://www.storagereview.com/wp-content/uploads/2025/11/newegg.webp) Newegg ](https://click.linksynergy.com/fs-bin/click?id=g5terNMDhz0&offerid=1207190.18&subid=0&type=4 "Opens in a new window") - [ ![Amazon Logo](https://www.storagereview.com/wp-content/uploads/2025/11/amazon.webp) Amazon ](https://amzn.to/4fLJUEW "Opens in a new window") Newsletter Subscribe to the StorageReview newsletter to stay up to date on the latest news and reviews. We promise no spam! 1 Leave this field empty if you’re human: ## Advertisement Content Categories [Facebook](https://www.facebook.com/@storagereview) [X](https://twitter.com/storagereview) [Instagram](https://www.instagram.com/storagereview/) [LinkedIn](https://www.linkedin.com/company/storagereview-com) [YouTube](https://www.youtube.com/user/storagereview?sub_confirmation=1) [Email](mailto:info@storagereview.com) [Spotify](https://open.spotify.com/show/1y6VnznABhHeOSMOmbDTz0) [Reddit](https://www.reddit.com/r/StorageReview/) [Discord](https://discord.gg/TwMHb4azdC) [RSS](https://www.storagereview.com/rss.xml) [TikTok](https://www.tiktok.com/@storagereview) Copyright © 1998-2025 Flying Pig Ventures, LLC Cincinnati, Ohio. All rights reserved. Manage your privacy To provide the best experiences, we and our partners use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us and our partners to process personal data such as browsing behavior or unique IDs on this site and show (non-) personalized ads. Not consenting or withdrawing consent, may adversely affect certain features and functions. Click below to consent to the above or make granular choices. Your choices will be applied to this site only. You can change your settings at any time, including withdrawing your consent, by using the toggles on the Cookie Policy, or by clicking on the manage consent button at the bottom of the screen. Functional Functional Always active The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Preferences Preferences The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user. Statistics Statistics The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Marketing Marketing The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes. Statistics Marketing Features Always active Special features Special purposes Always active - Manage options - Manage services - Manage {vendor\_count} vendors - [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/) Accept Deny Manage options Save preferences Manage options - {title} - {title} - {title} Manage your privacy To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions. Functional Functional Always active The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network. Preferences Preferences The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user. Statistics Statistics The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you. Marketing Marketing The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes. Statistics Marketing Features Always active Special features Special purposes Always active - Manage options - Manage services - Manage {vendor\_count} vendors - [Read more about these purposes](https://cookiedatabase.org/tcf/purposes/) Accept Deny Manage options Save preferences Manage options - {title} - {title} - {title} Manage consent Manage consent ```json {"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps","url":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps","name":"Get a Secure NAS in 4 Easy Steps - StorageReview.com","isPartOf":{"@id":"https:\/\/www.storagereview.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps#primaryimage"},"image":{"@id":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps#primaryimage"},"thumbnailUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2021\/04\/SecureNAS-Steps.png","datePublished":"2021-04-27T01:03:38+00:00","dateModified":"2021-04-27T15:40:41+00:00","description":"NAS systems are under attack by baddies looking to ransom your data. Don't be a chump, use these four easy steps for a secure NAS.","breadcrumb":{"@id":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps#primaryimage","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2021\/04\/SecureNAS-Steps.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2021\/04\/SecureNAS-Steps.png","width":1582,"height":1070,"caption":"Secure NAS Steps"},{"@type":"BreadcrumbList","@id":"https:\/\/www.storagereview.com\/review\/get-a-secure-nas-in-4-easy-steps#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.storagereview.com\/"},{"@type":"ListItem","position":2,"name":"Review","item":"https:\/\/www.storagereview.com\/review"},{"@type":"ListItem","position":3,"name":"Get a Secure NAS in 4 Easy Steps"}]},{"@type":"WebSite","@id":"https:\/\/www.storagereview.com\/#website","url":"https:\/\/www.storagereview.com\/","name":"StorageReview.com","description":"StorageReview.com is a leading provider of news and reviews throughout the entire IT stack - from the datacenter to the edge, and all points in between.","publisher":{"@id":"https:\/\/www.storagereview.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.storagereview.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.storagereview.com\/#organization","name":"StorageReview.com","url":"https:\/\/www.storagereview.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","contentUrl":"https:\/\/www.storagereview.com\/wp-content\/uploads\/2020\/02\/Storage-Reviews-2-2.png","width":344,"height":61,"caption":"StorageReview.com"},"image":{"@id":"https:\/\/www.storagereview.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/storagereview","http:\/\/youtube.com\/user\/storagereview"]}]} ```