How to secure a Synology NAS: settings to change after installation

Synology NAS devices hold the most valuable data in many offices — and they are a frequent ransomware target, especially when they are reachable from the internet. These settings are available in DSM 7.2; menu names can differ slightly between versions.

Step 1. Use a personal administrator account

Create an administrator with your own name and a long unique password. Keep the built-in admin account disabled. Daily users should not be in the administrators group.

Step 2. Turn on two-factor authentication

Enable 2-step verification for administrators (Personal → Security), and enforce it for administrators in Control Panel → Security → Account.

Step 3. Enable Auto Block and account protection

In Control Panel → Security → Protection, turn on Auto Block so addresses with repeated failed logins are blocked, and enable account protection.

Step 4. Turn on the firewall and limit access

In Control Panel → Security → Firewall, allow DSM and file sharing only from your office and VPN networks. Do not forward NAS ports on the router; for remote access, use a VPN. Disable QuickConnect if you do not need it.

Step 5. Keep DSM and packages updated

Enable automatic installation of important updates, and remove packages you do not use — each one adds possible vulnerabilities.

Step 6. Protect data with immutable snapshots and an off-site copy

In Snapshot Replication, schedule regular snapshots of shared folders and enable immutable snapshots, so they cannot be deleted even with an administrator account during the protection period. Use Hyper Backup to send a copy to another NAS or cloud storage outside the office. Run Security Advisor monthly.

RAID protects against a failed disk. Snapshots and off-site copies protect against everything else.

Need help with this? Contact CySec for a free consultation.

All articles